Cyber GRC Lead: Policy, Risk & Vendor Oversight

jj; New Brunswick (NJ); On-site; USD 140,000 - 190,000; Full time

Job summary

Johnson & Johnson's DePuy Synthes is seeking a Professional, Compliance Lead to lead cybersecurity governance, risk, and regulatory compliance across locations in New Jersey, Pennsylvania, Florida, Massachusetts, and Indiana. The role requires ownership of policy/framework, enterprise risk methodologies, and third-party risk oversight while delivering executive-level risk reporting.

The ideal candidate has 6+ years in GRC, strong knowledge of NIST/ISO, and relevant certifications

Qualifications

• 6 years of progressive experience in cybersecurity governance or related GRC discipline.
• Owns security policy and standards framework, governance lifecycle, and approvals.
• Advanced knowledge of NIST CSF/800-53, ISO 27001/27002, and COBIT.
• Experience designing a cyber risk assessment methodology and enterprise risk register.
• Experience defining KRIs and building executive risk reporting.
• Experience leading third-party cyber risk programs and vendor assessments.
• Strong facilitation and influencing skills with senior stakeholders.

Responsibilities

• Lead cybersecurity policy and standards program end to end, governing lifecycle and attestation.
• Define and maintain enterprise cyber risk framework and scoring model.
• Direct cyber risk assessment program across applications, infrastructure, and processes.
• Own governance of the enterprise cyber risk register and escalation.
• Chair cybersecurity governance forums and document outcomes.
• Build executive risk reporting model for CIO, CISO, and leadership teams.
• Define, baseline, and operationalize cyber risk metrics and KRIs.
• Lead third-party cyber risk oversight including vendor assessments and contractual security requirements.
• Coordinate with Internal Audit, Legal, Privacy, Quality, regulators, and customers as required.

Skills

Cybersecurity governance

IT risk management

Technology compliance

GRC discipline

Policy & standards governance

Threat & risk reporting

Facilitation with senior stakeholders

Education

CISSP

CRISC

CISM

CISA

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Power BI

Job description

Johnson & Johnson's DePuy Synthes is seeking a Professional, Compliance Lead to lead cybersecurity governance, risk, and regulatory compliance across locations in New Jersey, Pennsylvania, Florida, Massachusetts, and Indiana. The role requires ownership of policy/framework, enterprise risk methodologies, and third-party risk oversight while delivering executive-level risk reporting.

The ideal candidate has 6+ years in GRC, strong knowledge of NIST/ISO, and relevant certifications