Cyber Governance & Policy Strategist

Johnson & Johnson MedTech; New Brunswick (NJ); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson, via DePuy Synthes, seeks a governance & policy Analyst to design and operationalize the cybersecurity policy framework. You will manage the policy library, risk assessments, and executive reporting for CIO/CISO audiences.

With 4+ years in cybersecurity governance, you will partner across IT, Legal, Privacy, and Quality to strengthen risk-informed decision-making and cyber culture.

Qualifications

• Bachelor's degree in IT, Cybersecurity, or related field.
• 4+ years in cybersecurity governance or IT risk management.
• Experience drafting and maintaining security policies within governance lifecycle.
• Knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, COBIT.
• Strong written communication; ability to translate risk for leadership.

Responsibilities

• Own cybersecurity policy and standards library with lifecycle management.
• Maintain cyber risk management framework, scoring, and workflows.
• Run risk assessments across applications, infrastructure, and processes.
• Administer enterprise risk register and remediation tracking.
• Coordinate governance forums and executive reporting.
• Develop policy communications and cyber culture initiatives.
• Support third-party risk oversight including SOC 2 / ISO reviews.
• Map policy controls to NIST/ISO/HIPAA/GDPR guidance.

Skills

Analytical reasoning

Communication

Risk assessments

Cybersecurity governance

Policy drafting

Leadership without authority

Education

Bachelor's in IT/Cybersecurity/Info Systems

Master's in Cybersecurity/Business Administration (preferred)

Tools

Power BI

Tableau

SOC 2 / ISO 27001 evidence tools

OneTrust / Archer (GRC tools)

Job description

Johnson & Johnson, via DePuy Synthes, seeks a governance & policy Analyst to design and operationalize the cybersecurity policy framework. You will manage the policy library, risk assessments, and executive reporting for CIO/CISO audiences.

With 4+ years in cybersecurity governance, you will partner across IT, Legal, Privacy, and Quality to strengthen risk-informed decision-making and cyber culture.