M&A Cybersecurity Due Diligence Lead (Pre-Close)

Johnson & Johnson Co.; Salem (OR); Remote; USD 122,000 - 213,000; Full time

Job summary

Johnson & Johnson is seeking a Senior Manager, Information Security Risk Management (ISRM) Acquisitions & Divestitures, Pre‑Close. You will lead deal‑level cybersecurity assessments, translate evidence into risk insights, and guide transactional decisions with cross‑functional teams.

This role requires strong technical depth across security domains and experience shaping Day 1 security priorities for post‑close integration or separation. Remote work options may be case‑by‑case.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related discipline.
• Advanced degree (MBA, MS, or equivalent) preferred.
• 8+ years of progressive experience in cybersecurity, information risk management, technology delivery, security architecture, M&A transaction support, due diligence, integration/separation.

Responsibilities

• Lead Pre‑Close Cybersecurity Due Diligence for acquisitions and divestitures.
• Evaluate target environments for security architecture, IAM, cloud, data protection, and cyber resilience.
• Translate technical findings into business-focused risk conclusions and remediation needs.
• Coordinate with Corporate Development, Legal, Privacy, Finance and Technology Services.
• Handoff Day 1 objectives and TSA considerations to post‑close teams.

Skills

Cybersecurity

Information risk management

M&A due diligence

Security architecture

Regulatory compliance

Education

Bachelor's degree in Information Security

MBA or MS preferred

Tools

NIST protocols

ISO 27001

GDPR/HIPAA

Job description

Johnson & Johnson is seeking a Senior Manager, Information Security Risk Management (ISRM) Acquisitions & Divestitures, Pre‑Close. You will lead deal‑level cybersecurity assessments, translate evidence into risk insights, and guide transactional decisions with cross‑functional teams.

This role requires strong technical depth across security domains and experience shaping Day 1 security priorities for post‑close integration or separation. Remote work options may be case‑by‑case.