Cyber GRC Policy Analyst: Risk, Policy & Reporting

Antler Co; Town of Florida (NY); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson is recruiting a Professional, Governance & Policy Analyst within DePuy Synthes to design, maintain, and operationalize cyber policy, risk methodology, and governance reporting. You will manage policy libraries, risk registers, and executive reporting while partnering across IT, Legal, Privacy, and Quality functions to strengthen risk-informed decisions.

The role focuses on aligning controls with frameworks (NIST, ISO, HIPAA, GDPR) and maturing cyber culture across the

Qualifications

• Bachelor’s degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business, or related discipline.
• Master’s degree in Cybersecurity, Information Systems, or Business Administration preferred.
• 4+ years of experience in cybersecurity governance, IT risk management, technology compliance, or a related GRC discipline.
• Strong written communication skills, with ability to translate technical risk into business language.
• Familiarity with NIST CSF, NIST 800-53, ISO 27001/27002, COBIT.

Responsibilities

• Own the cybersecurity policy and standards library, authoring, reviewing, and maintaining policies, standards, procedures, and guidelines on a defined lifecycle.
• Maintain and improve the cyber risk management framework and methodology, including risk taxonomy and scoring.
• Facilitate and document cyber risk assessments across applications, infrastructure, and processes.
• Administer the risk register as the single source of truth with ownership and aging analysis.
• Coordinate cybersecurity governance forums and prepare decision materials for leadership.

Skills

GRC governance

Policy drafting

Cybersecurity risk

Regulatory awareness

Communication skills

Education

Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business, or a related discipline

Master's degree in Cybersecurity, Information Systems, or Business Administration preferred

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Power BI

Tableau

AWS

Job description

Johnson & Johnson is recruiting a Professional, Governance & Policy Analyst within DePuy Synthes to design, maintain, and operationalize cyber policy, risk methodology, and governance reporting. You will manage policy libraries, risk registers, and executive reporting while partnering across IT, Legal, Privacy, and Quality functions to strengthen risk-informed decisions.

The role focuses on aligning controls with frameworks (NIST, ISO, HIPAA, GDPR) and maturing cyber culture across the