Cyber GRC Policy & Risk Analyst

Antler Co; New Brunswick (NJ); On-site; USD 79,000 - 142,000; Full time

Benefits offered by this job

Travel up to 15% domestic travel

Job summary

Johnson & Johnson is recruiting a Governance & Policy Analyst in New Jersey to design and maintain the cybersecurity policy framework, risk methodology, and governance reporting for DePuy Synthes. The role partners with IT, Legal, Privacy, Quality, and Procurement to strengthen risk-informed decisions and cyber culture.

Responsibilities include managing the cyber policy library, risk register, forums, and executive reporting; ensuring alignment with NIST, ISO, HIPAA, GDPR, and FDA guidance,

Qualifications

• Bachelor's degree in IT, cybersecurity, information systems, risk management, or a related discipline.
• Master's degree in cybersecurity, information systems, or business administration preferred.
• 4+ years in cybersecurity governance, IT risk management, or related GRC discipline.
• Experience authoring and maintaining security policies within a governance lifecycle.
• Knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, COBIT.
• Experience conducting risk assessments and maintaining a risk register.
• Experience supporting governance forums, reporting, metrics, dashboards.
• Familiarity with third‑party risk, SOC 2/ISO certifications.
• Strong written communication and ability to translate risk for leadership.

Responsibilities

• Own cyber risk governance processes and reporting for leadership.
• Maintain cyber risk framework, taxonomy, scoring, and thresholds.
• Facilitate risk assessments across apps, infra, and processes; track in risk register.
• Coordinate governance forums and executive reporting packages.
• Map policy to external frameworks (NIST, ISO, HIPAA, GDPR) and crosswalk docs.
• Support third‑party risk reviews and vendor security oversight.
• Develop cyber risk metrics and KRIs; drive proactive risk management.
• Assist internal/external audits with governance documentation.

Skills

Cybersecurity governance

IT risk management

Policy authoring

GRC frameworks

Vendor risk

Education

Bachelor's degree in IT/Cybersecurity/Info Systems/Risk/Business

Master's degree in Cybersecurity/IS/Business Admin (preferred)

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Job description

Johnson & Johnson is recruiting a Governance & Policy Analyst in New Jersey to design and maintain the cybersecurity policy framework, risk methodology, and governance reporting for DePuy Synthes. The role partners with IT, Legal, Privacy, Quality, and Procurement to strengthen risk-informed decisions and cyber culture.

Responsibilities include managing the cyber policy library, risk register, forums, and executive reporting; ensuring alignment with NIST, ISO, HIPAA, GDPR, and FDA guidance,