Cyber Governance & Policy Analyst

Johnson & Johnson MedTech; Raynham (MA); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson DePuy Synthes is seeking a Professional, Governance & Policy Analyst to design, maintain, and operationalize the cybersecurity policy framework and risk reporting. This role partners across IT, Legal, Privacy, Quality, and Procurement to strengthen risk-informed decisions and cyber culture.

The candidate will manage the risk register, coordinate governance forums, and translate regulatory expectations into clear, actionable standards in a busy cybersecurity program.

Qualifications

• Bachelor's degree in IT/Cybersecurity, Information Systems, Risk Mgmt, or related field.
• Master's degree in Cybersecurity or Business preferred.
• 4+ years in cybersecurity governance, IT risk management, or GRC.
• Experience authoring security policies and procedures in a governance lifecycle.
• Familiarity with NIST CSF, NIST 800-53, ISO 27001/27002, COBIT.
• Experience conducting risk assessments and maintaining a risk register.
• Experience producing leadership-ready risk metrics and dashboards.
• Knowledge of third-party risk assessments and SOC 2 / ISO certifications.
• Strong written communication translating risk into business language.

Responsibilities

• Own the cybersecurity policy and standards library across lifecycle.
• Maintain cyber risk management framework and scoring criteria.
• Lead cyber risk assessments across applications and processes.
• Maintain enterprise risk register and remediation tracking.
• Coordinate cybersecurity governance forums and executive reporting.
• Publish executive and operational risk reports for CIO/CISO audiences.
• Design KRIs, thresholds, and trend analyses to drive risk management.
• Support third-party risk oversight including SOC 2 / ISO reviews.
• Map policy requirements to NIST, ISO, HIPAA, GDPR, and FDA guidance.
• Collaborate with IT Controls, Legal, Privacy, Quality, and Procurement.

Skills

GRC governance

IT risk mgmt

Policy writing

Risk assessment

Executive reporting

Vendor risk

Written communication

Education

Bachelor's degree in IT/Cybersecurity

Master's degree preferred

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Power BI

Tableau

AWS

Azure

Job description

Johnson & Johnson DePuy Synthes is seeking a Professional, Governance & Policy Analyst to design, maintain, and operationalize the cybersecurity policy framework and risk reporting. This role partners across IT, Legal, Privacy, Quality, and Procurement to strengthen risk-informed decisions and cyber culture.

The candidate will manage the risk register, coordinate governance forums, and translate regulatory expectations into clear, actionable standards in a busy cybersecurity program.