Cyber Governance & Policy Analyst

Johnson Johnson; New Brunswick (NJ); On-site; USD 110,000 - 170,000; Full time

Job summary

Johnson & Johnson is seeking a Professional, Governance & Policy Analyst within Cybersecurity, GRC, IT Controls & Cyber Culture. The role designs and maintains the policy framework, risk methodology, and governance reporting, partnering with IT, Legal, Privacy, Quality, Procurement, and business functions to inform risk-aware decisions.

The analyst supports audit, regulatory inquiries, and third‑party assessments, driving automation and consistent evidence collection across the enterprise.

Qualifications

• Bachelor's degree in Informat or related field.
• Experience applying GRC frameworks to translate regulatory expectations into standards.
• Strong collaboration with IT, Legal, Privacy, Quality, Procurement, and business functions.

Responsibilities

• Own the cybersecurity policy and standards library and maintain lifecycle documents.
• Manage cyber risk assessments across apps, infra, and processes; update enterprise risk register.
• Coordinate governance forums and produce executive reporting for CIO/CISO and leadership.
• Develop cyber risk KPIs and KRIs with thresholds and trend analysis.
• Support third-party risk oversight, including vendor risk and evidence evaluation.
• Map policy requirements to frameworks like NIST CSF, ISO 27001, HIPAA, GDPR; maintain crosswalks.

Education

Bachelor's degree in Informat

Job description

Johnson & Johnson is seeking a Professional, Governance & Policy Analyst within Cybersecurity, GRC, IT Controls & Cyber Culture. The role designs and maintains the policy framework, risk methodology, and governance reporting, partnering with IT, Legal, Privacy, Quality, Procurement, and business functions to inform risk-aware decisions.

The analyst supports audit, regulatory inquiries, and third‑party assessments, driving automation and consistent evidence collection across the enterprise.