{"id":4053698,"url":"https://alion.io/job/johnson-johnson-director-ai-security","title":"Director, AI Security","company":{"id":14152,"name":"Johnson & Johnson","domain":"jnj.com","url":"https://alion.io/company/jnj","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":90,"open_postings":235,"ghost_share":0,"stale_share":0.613,"repost_share":0.004,"time_to_fill_p50_days":11,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["New Brunswick, United States","United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"EU AI Act","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Machine Learning","optional":false},{"name":"RAG","optional":false},{"name":"Red Teaming","optional":false},{"name":"Fine-tuning","optional":true},{"name":"Model Context Protocol","optional":true},{"name":"Multi-Agent Systems","optional":true},{"name":"NIST AI RMF","optional":true},{"name":"OWASP","optional":true}],"status":"live","first_seen_at":"2026-11-10T00:00:00Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-11T03:22:35Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com\nAs guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.\nJob Function:\nTechnology Enterprise Strategy & SecurityJob Sub Function:\nSecurity & ControlsJob Category:\nPeople LeaderAll Job Posting Locations:\nNew Brunswick, New Jersey, United States of America, Raritan, New Jersey, United States of AmericaJob Description:\nJob Description:\nThe Director, AI Security is a cybersecurity leader accountable for establishing and scaling enterprise AI security capabilities that reduce cybersecurity risk across Johnson & Johnson. Capabilities span LLM model and harness security (including lifecycle management), agent security (including non-human identity), end-user AI usage management, AI supply chain security, AI runtime protection, AI security assurance through the lifecycle, ongoing AI security observability and monitoring, and AI application security.\nThe role is accountable for the security of enterprise AI platforms, commercial SaaS AI services, embedded AI capabilities in third-party products, open source models and components, internally developed AI solutions, and agent ecosystems, enabling the business to adopt AI securely while protecting sensitive information and critical operations within a regulated healthcare environment (including GxP/validated systems, HIPAA, and the EU AI Act).\nThe Director, AI Security will lead a team accountable for addressing AI-related risks such as prompt injection, sensitive data exposure, excessive agent privileges, tool misuse, model and data poisoning, and compromised AI supply chains. This leader will validate AI control effectiveness through adversarial testing, work closely with the IAM team on agentic identity, and partner with Vulnerability Management and Application Security teams to drive timely remediation.\nThe role also partners with Cyber Defense and GSO on threat detection and response, and with AI Governance, Privacy, Security and Technology Architecture, and Risk Management teams to ensure security controls are enabled across AI technologies through enterprise AI standards, onboarding processes, and operational guardrails. Those teams retain ownership of governance and architecture decisions.\nThe role will also operationalize frontier AI and other advanced models to identify and prioritize cybersecurity exposures, accelerate investigation in partnership with Cyber Defense and GSO, and expedite remediation with appropriate safeguards and human validation. Success will be measured through expanded security coverage, effective protection of AI systems and models, faster risk identification and remediation, and demonstrable reduction in enterprise cybersecurity risk.\nKey Responsibilities:\nBe accountable for establishing and scaling the enterprise AI security capabilities, including LLM model and harness security (and lifecycle management), agent security (including non-human identity), end-user AI usage management, AI supply chain security, AI runtime protection, AI security assurance through the lifecycle, ongoing AI security observability and monitoring, and AI application security.\nEstablish AI discovery capabilities to identify enterprise use of generative AI, AI applications, agents, and models across the full AI footprint, and prioritize gaps in security coverage.\nEstablish end-user AI usage management, including access enforcement and data protection controls for generative AI use, to prevent unauthorized access and sensitive information exposure.\nOwn AI agent identity and authorization security, including non-human identities, credentials, service accounts, and least-privilege permissions, working closely with the IAM team with a focus on agentic identity.\nPartner with key stakeholder teams to integrate security testing and protective controls throughout AI system development, deployment, and ongoing operation.\nEstablish AI onboarding and assurance, including security evaluation of new AI capabilities before they enter production: security assessment of new models (and their ongoing management), agent security reviews, AI red-team guidance, supply chain assurance, and runtime monitoring requirements.\nDefine security approval criteria for production deployment of AI models, agents, and applications, including emerging and frontier model capabilities.\nImplement model and AI supply chain security controls to detect and mitigate model and data poisoning, compromised components, and exposures affecting deployed models.\nEnsure continuous adversarial testing of models, AI applications, and agent workflows to identify prompt injection and other high-impact threats, validate defenses, and verify remediation.\nIntegrate AI security telemetry and detections into security operations, and partner with Cyber Defense on AI-specific detection, triage, and incident response playbooks.\nDeploy frontier AI and other advanced models to identify and prioritize cybersecurity exposures, accelerate investigations in partnership with Cyber Defense and GSO, and expedite remediation with appropriate safeguards and human validation.\nPartner with AI Governance, Privacy, Security and Technology Architecture, and Risk Management teams to ensure security controls are enabled across AI technologies through enterprise AI standards, onboarding processes, and operational guardrails.\nOwn AI security vendor relationships and budget, including vendor selection, performance management, and spend; maintain vendor strategy and capability rationalization.\nPartner with Vulnerability Management, Application Security, and business teams to drive timely remediation of AI-related exposures.\nBe accountable for enterprise AI security standards adoption, measurement of AI security control effectiveness, executive risk communication, and the AI security roadmap and investment planning in partnership with Security Architecture.\nEducation:\nBachelor's degree in Information Security, Computer Science, Engineering, Information Systems, or a related discipline, or equivalent experience.\nAdvanced degree (MBA, MS, or equivalent) preferred.\nRequired Experience and Skills:\n12+ years of progressive experience in cybersecurity, application security, security engineering, or related disciplines, including leadership of enterprise security capabilities, plus recent hands-on experience securing AI-enabled systems. The 12+ years refers to overall cybersecurity experience, not AI-specific experience.\nDemonstrated experience implementing, operating, and scaling AI security capabilities across end-user generative AI services, AI applications, agents, and models, with measurable improvements in security coverage and risk reduction.\nWorking understanding of AI and machine learning lifecycles, large language models, retrieval-augmented generation (RAG), model APIs, and agent tool integrations, including their security implications across development, deployment, and inference.\nPractical expertise in AI discovery, identity and access enforcement, least-privilege agent permissions, secrets protection, data loss prevention, and runtime safeguards, with demonstrated ability to assess and mitigate prompt injection, sensitive data exposure, excessive agency, tool misuse, insecure output handling, model theft, adversarial manipulation, data and model poisoning, and AI supply chain compromise.\nExperience in cloud and platform security, including securing the cloud, data, and identity platforms on which AI workloads and services run.\nExperience integrating AI security telemetry with security operations and incident response processes in partnership with Cyber Defense, including detection engineering, investigation, containment, and remediation of threats affecting AI systems and models.\nProven ability to lead technical security teams, manage vendors, budgets, and concurrent capability deployments, and partner with engineering, security operations, and business stakeholders across a global, highly matrixed enterprise.\nStrong executive stakeholder management, technical judgment, and communication skills, with the ability to translate emerging AI threats into prioritized defenses and communicate business impact, control effectiveness, security coverage, and remediation outcomes.\nPreferred Experience:\nExperience securing production multi-agent systems and Model Context Protocol (MCP) integrations, including delegated authorization, isolated tool execution, inter-agent trust boundaries, and defenses against memory poisoning and cascading compromise.\nDeep technical experience evaluating open-weight and fine-tuned models for backdoors, poisoning, model extraction, and training-data leakage, and building automated adversarial evaluation suites informed by NIST adversarial machine learning guidance, MITRE ATLAS, and OWASP AI security guidance.\nExperience embedding AI security testing and controls into software delivery and MLOps pipelines, including model and dependency assessment, adversarial testing, AI red teaming, remediation validation, and repeatable evaluation of models, applications, and agent workflows.\nAdvanced machine learning engineering or frontier model research experience, including model development, fine-tuning, and evaluation, and adversarial AI research or specialized red-team experience.\nWorking knowledge of the NIST AI Risk Management Framework and Generative AI Profile, OWASP guidance for LLM and agentic application security, and MITRE ATLAS, with the ability to translate relevant threats and recommended practices into operational controls and security tests.\nPractical experience applying frontier AI or other advanced models to cybersecurity use cases, including exposure identification, risk prioritization, investigation, and remediation automation, with a track record of moving frontier-model-powered vulnerability discovery and remediation from pilot to sustained production use, including validation of generated fixes, bounded execution, approval checkpoints, rollback, and quantified improvements in remediation speed and quality.\nExperience scaling AI security across cloud-hosted and self-hosted models in regulated healthcare, pharmaceutical, or MedTech environments, including protection of research, clinical, or manufacturing data and validation of controls without disrupting critical workflows.\nDemonstrated contributions to the AI security field through responsibly disclosed vulnerabilities, published applied research, open-source security or evaluation tools, or substantive contributions to OWASP, MITRE ATLAS, or comparable industry initiatives, with evidence of translating findings into deployed defenses.\nExperience with skill security and multi-turn agentic (loop prompt) security.\nRelevant certifications such as CISSP, CISM, or equivalent credentials preferred; AI security certifications such as GIAC AI Platform Security (GAIPS), GIAC AI Security Automation Engineer (GASAE), or ISACA Advanced in AI Security Management (AAISM) are particularly desirable.\nLeadership Experience:\nOperates as an enterprise-minded cybersecurity leader who balances delivery speed, regulatory and enterprise obligations, technical risk, stakeholder expectations, operational continuity, and value realization.\nMaintains security by design through clear technical di...","description_format":"text","description_chars":15486,"description_truncated":true,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Military spouse friendly","Parental leave","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Washington","iso":null,"kind":"city"},{"name":"Colorado","iso":null,"kind":"city"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Prescription Drugs","Surgical Instruments & Devices","Information Security","Orthopedic & Spine Implants"],"lifecycle":[{"event":"open","at":"2026-11-11T03:22:35Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 66 · green card filings: 18","filings_12m":66,"filings_prev_12m":44,"green_card_filings_12m":18,"median_offered_wage_usd":166964,"route":null,"cap_exempt":false,"checked_at":"2026-11-10T11:34:35+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":5}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":11,"reasons":["conf:1","win:early","comp:brand"],"computed_at":"2026-11-11T05:07:29Z"},"pay":null,"html_url":"https://alion.io/job/johnson-johnson-director-ai-security","json_url":"https://alion.io/job/johnson-johnson-director-ai-security.json","meta":{"generated_at":"2026-11-11T05:07:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6335,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14152},"rest":"https://alion.io/mcp/rest/get_company?id=14152"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjohnson-johnson-director-ai-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjohnson-johnson-director-ai-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjohnson-johnson-director-ai-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/johnson-johnson-director-ai-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjohnson-johnson-director-ai-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4053698}},{"tool":"search_jobs","arguments":{"company":"jnj.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4053698},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}