Cyber GRC Lead - Policy, Risk & Exec Reporting

Antler Co; New Brunswick (NJ); On-site; USD 140,000 - 190,000; Full time

Job summary

Johnson & Johnson's DePuy Synthes unit seeks a seasoned Professional, Compliance Lead to steer cybersecurity governance and risk across the org. Lead policy, risk frameworks, and third-party oversight while coordinating with internal audit and regulators.

The role requires expertise in GRC, frameworks like NIST/ISO, and strong stakeholder engagement to ensure robust controls and executive reporting.

Qualifications

• 6 years of progressive experience in cybersecurity governance or related GRC discipline.
• Owns security policy and standards framework with lifecycle governance.
• Experience designing and operating enterprise risk registers and KRIs.
• Strong working knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, COBIT.
• Proven ability to lead third-party cyber risk programs and audits.
• Proficiency with data visualization tools for executive risk reporting.
• Hands-on experience with GRC platforms and cloud governance.
• Experience liaising with Internal Audit, Legal, Privacy, QA and regulators.

Responsibilities

• Lead cybersecurity policy and standards program from design to review and attestation.
• Define enterprise cyber risk framework, scoring, appetite, and escalation thresholds.
• Run cyber risk assessments across applications, infra, and change programs.
• Maintain enterprise cyber risk register with data quality and timely escalation.
• Chair governance forums and document decisions and actions.
• Develop executive risk reporting for CIO, CISO, and leaders.
• Define KRIs and predictive signals for proactive intervention.
• Oversee third-party cyber risk using vendor tiering and security requirements.
• Maintain regulatory mapping (HIPAA, GDPR, FDA guidance, SOX ITGC).
• Collaborate with IT Controls and SOX teams for coherent assurance.
• Coordinate with Internal Audit, regulators, and customer assessments.
• Assess impact of cloud migrations and platform changes pre-go-live.
• Drive cyber culture through policy communications and training.
• Identify automation opportunities in GRC workflows and reporting.

Skills

NIST CSF

NIST 800-53

ISO 27001/27002

COBIT

Vendor risk management

GRC governance

Power BI

Tableau

SQL

cloud governance

ISMS

Security policies

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Job description

Johnson & Johnson's DePuy Synthes unit seeks a seasoned Professional, Compliance Lead to steer cybersecurity governance and risk across the org. Lead policy, risk frameworks, and third-party oversight while coordinating with internal audit and regulators.

The role requires expertise in GRC, frameworks like NIST/ISO, and strong stakeholder engagement to ensure robust controls and executive reporting.