Lead Product Security Architect

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com

As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world.  We provide an inclusive work environment where each person is considered as an individual.  At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function:

R&D Product Development

Job Sub Function:

R&D Software/Systems Engineering

Job Category:

Scientific/Technology

All Job Posting Locations:

Santa Clara, California, United States of America

Job Description:

About Surgery:
 

Fueled by innovation at the intersection of biology and technology, we’re developing the next generation of smarter, less invasive, more personalized treatments.

Are you passionate about improving and expanding the possibilities of surgery? Ready to join a team that’s reimagining how we heal? Our Surgery team will give you the chance to deliver surgical technologies and solutions to surgeons and healthcare professionals around the world. Your contributions will help effectively treat some of the world’s most prevalent conditions such as obesity, cardiovascular disease and cancer. Patients are waiting.

Your unique talents will help patients on their journey to wellness. Learn more at https://www.jnj.com/medtech

We are searching for the best talent for our Lead Product Security Architect position.  This position will be located in Santa Clara, CA

Purpose:

The Lead Product Security Architect will own the cybersecurity architecture, system-level view, and technical implementation of the OTTAVA surgical robot, with potential to impact millions of patients and expand the capabilities of physicians globally.
 

This role is not focused on enterprise IT, or cloud security operations. This individual will be a key technical and strategic leader on one of the most exciting programs in J&J and in healthcare in general! The candidate must bring a strong blend of security awareness, technical ability, and regulatory awareness. They must also balance depth in cybersecurity with a passionate focus on understanding and meeting the needs of clinicians and operating room staff. This role reports to the Sr. Director, Robotics Software.

You will be responsible for:

• Own the end-to-end cybersecurity architecture for the OTTAVA product, a FDA-regulated device, maintaining a system-level view of security and ensuring security-by-design from firmware and embedded software to external interfaces
• Be the singular R&D voice on security, clearly communicating and alinging approaches with internal (quality, information security, regulatory) and external (FDA) stakeholders
• Act as the technical authority for cybersecurity decisions and tardeoffs
• Design and oversee implementation of technical cybersecurity controls, primarily based in software and network infrastructure
• Lead R&D cyber reviews and documentation (threat modeling, risk assessment) in partnership with internal collaborators
• Translate security risks into patient safety, regulatory, and business impact for non-security stakeholders
• Take a risk-based approach when assessing the relationship between cybersecurity needs, patient safety, regulatory expectations, and quality system requirements

Experience and Skills:

Required:

• 10+ years professional experience in software development or systems engineering with a focus on device security
• 5+ years experience with hands-on technical leadership in cybersecurity
• Demonstrated ability to deliver results on time within constraints by creatively adapting processes and using resources is required
• Experience with regulatory guidance (preferably FDA) on cybersecurity implementation and documentation, pre- and post-market surveillance, and risk-assessment is required
• Proficien