Professional, Compliance Lead

Antler Co; New Brunswick (NJ); On-site; USD 140,000 - 190,000; Full time

Job summary

Johnson & Johnson's DePuy Synthes unit seeks a seasoned Professional, Compliance Lead to steer cybersecurity governance and risk across the org. Lead policy, risk frameworks, and third-party oversight while coordinating with internal audit and regulators.

The role requires expertise in GRC, frameworks like NIST/ISO, and strong stakeholder engagement to ensure robust controls and executive reporting.

Qualifications

• 6 years of progressive experience in cybersecurity governance or related GRC discipline.
• Owns security policy and standards framework with lifecycle governance.
• Experience designing and operating enterprise risk registers and KRIs.
• Strong working knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, COBIT.
• Proven ability to lead third-party cyber risk programs and audits.
• Proficiency with data visualization tools for executive risk reporting.
• Hands-on experience with GRC platforms and cloud governance.
• Experience liaising with Internal Audit, Legal, Privacy, QA and regulators.

Responsibilities

• Lead cybersecurity policy and standards program from design to review and attestation.
• Define enterprise cyber risk framework, scoring, appetite, and escalation thresholds.
• Run cyber risk assessments across applications, infra, and change programs.
• Maintain enterprise cyber risk register with data quality and timely escalation.
• Chair governance forums and document decisions and actions.
• Develop executive risk reporting for CIO, CISO, and leaders.
• Define KRIs and predictive signals for proactive intervention.
• Oversee third-party cyber risk using vendor tiering and security requirements.
• Maintain regulatory mapping (HIPAA, GDPR, FDA guidance, SOX ITGC).
• Collaborate with IT Controls and SOX teams for coherent assurance.
• Coordinate with Internal Audit, regulators, and customer assessments.
• Assess impact of cloud migrations and platform changes pre-go-live.
• Drive cyber culture through policy communications and training.
• Identify automation opportunities in GRC workflows and reporting.

Skills

NIST CSF

NIST 800-53

ISO 27001/27002

COBIT

Vendor risk management

GRC governance

Power BI

Tableau

SQL

cloud governance

ISMS

Security policies

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Job description

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com.

As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function

Technology Enterprise Strategy & Security

Job Sub Function

Security & Controls

Job Category

Scientific/Technology

All Job Posting Locations:

New Brunswick, New Jersey, United States of America

Job Description

DePuy Synthes is recruiting for a Professional, Compliance Lead, located in Raritan, New Jersey or West Chester, Pennsylvania or Palm Beach Gardens, Florida or Raynham, Massachusetts or Warsaw, Indiana.

• Join our change journey at J&J—help shape what’s next
• Step into a high-impact career opportunity with real visibility

THE OPPORTUNITY

The Professional, Compliance Lead is a seasoned individual contributor within the Cybersecurity function, GRC, IT Controls & Cyber Culture sub-function, accountable for leading the cybersecurity compliance and governance agenda across DePuy Synthes. This role owns the policy and standards framework, sets the enterprise cyber risk methodology, leads risk assessments and register governance, and drives the reporting cadence that informs executive and Board-level decision-making. The Compliance Lead directs third-party risk oversight, defines the metrics and KRI model that measures program health, and serves as the primary liaison to Internal Audit, Legal, Privacy, Quality, and external regulators. Applying advanced knowledge of GRC frameworks and regulatory obligations, this role establishes best-in-class policies, procedures, and plans for the area.

Responsibilities

• Lead the cybersecurity policy and standards program end to end — setting the governance lifecycle, approving content, driving annual review and attestation, and adjudicating exceptions and risk acceptances.
• Define and maintain the enterprise cyber risk framework and methodology, including risk taxonomy, scoring model, risk appetite and tolerance statements, and escalation thresholds.
• Direct the cyber risk assessment program across applications, infrastructure, business processes, and major change initiatives; ensure consistency of method, quality of output, and traceability of results.
• Own governance of the enterprise cyber risk register — enforcing data quality, ownership accountability, aging discipline, and timely escalation of elevated or overdue risks to leadership.
• Chair and orchestrate cybersecurity governance forums, setting agendas, framing decisions, documenting outcomes, and holding owners accountable for committed actions.
• Build and deliver the executive reporting model — translating aggregated risk, control, and compliance data into concise business-impact narratives for CIO, CISO, and senior leadership audiences.
• Define, baseline, and operationalize cyber risk metrics and Key Risk Indicators (KRIs), establishing thresholds, trend analysis, and predictive signals that drive proactive intervention.
• Lead third-party cyber risk oversight — setting the vendor tiering model, assessment standards, contractual security requirements, and continuous monitoring approach for critical and high-risk suppliers.
• Maintain the regulatory and framework mapping library (NIST CSF, ISO 27001, HIPAA, GDPR, FDA cybersecurity guidance, SOX ITGC), rationalizing overlapping requirements to reduce duplicate control effort.
• Partner with the IT Controls and SOX teams to align governance requirements with control design and testing, ensuring a coherent and non-duplicative assurance landscape.
• Serve as the primary point of contact for Internal Audit, external auditors, regulators, and customer security assessments — coordinating evidence, responses, and issue remediation.
• Assess and govern the compliance impact of major technology change, including cloud migrations, ERP and platform implementations, and separation/carve-out activity, defining requirements prior to go-live.
• Drive the cyber culture and awareness agenda — shaping policy communications, training strategy, and targeted enablement to strengthen accountability and risk-aware behavior enterprise-wide.
• Identify and lead automation opportunities across GRC workflows, evidence collection, and reporting to improve efficiency, data integrity, and program scalability.

Required

ABOUT YOU:

• 6 years of progressive experience in cybersecurity governance, IT risk management, technology compliance, or a related GRC discipline.
• Demonstrated ownership of a security policy and standards framework, including authorship, governance lifecycle, exception management, and stakeholder approval.
• Advanced working knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT, with the ability to rationalize requirements across multiple frameworks.
• Proven experience designing and operating a cyber risk assessment methodology and enterprise risk register at scale.
• Experience defining KRIs and building executive-level risk reporting that drives leadership decisions.
• Experience leading third-party/vendor cyber risk programs, including assessment standards, SOC 2 / ISO evidence review, and contractual security requirements.
• Strong facilitation and influencing skills, with a track record of driving accountability across senior stakeholders without direct authority.

Preferred

• MedTech, Life Sciences, or other regulated industry background; working knowledge of HIPAA, GDPR, and FDA medical device cybersecurity expectations.
• Experience standing up or maturing a GRC function within a divestiture, carve-out, spin-off, or standalone entity.
• Hands-on experience with GRC platforms (e.g., ServiceNow IRM, Archer, OneTrust, AuditBoard), including workflow design and reporting configuration.
• Experience coordinating directly with external auditors, regulators, or major customer security assessment programs.
• Familiarity with cloud governance (AWS, Azure) and control expectations for SaaS and cloud-hosted environments.
• Proficiency with data visualization and analytics tools (Power BI, Tableau, SQL) for risk metrics and executive dashboards.
• Experience applying Generative AI / LLM-enabled tooling to accelerate policy drafting, control mapping, and third-party assessment review.
• Experience designing and scaling security awareness and cyber culture programs.

Other

• Travel: Up to 15% domestic travel expected across DePuy Synthes sites.
• Language: English proficiency required.
• Certifications: CISSP, CRISC, CISM, or CISA required or in progress. CGRC, ISO 27001 Lead Implementer/Auditor, or CIPP preferred.

Johnson & Johnson announced plans to separate our Orthopedics business to establish a standalone orthopedics company, operating as DePuy Synthes. The process of the planned separation is anticipated to be completed within 18 to 24 months, subject to legal requirements, including consultation with works councils and other employee representative bodies, as may be required, regulatory approvals and other customary conditions and approvals. Should you accept this position, it is anticipated that, following conclusion of the transaction, you would be an employee of DePuy Synthes and your employment would be governed by DePuy Synthes employment processes, programs, policies, and benefit plans. In that case, details of any planned changes would be provided to you by DePuy Synthes at an appropriate time and subject to any necessary consultation processes.

Johnson & Johnson is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or other characteristics protected by federal, state or local law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act.

Johnson & Johnson is committed to providing an interview process that is inclusive of our applicants’ needs. If you are an individual with a disability and would like to request an accommodation, external applicants please contact us via https://www.jnj.com/contact-us/careers, internal employees contact AskGS to be directed to your accommodation resource.

#DePuySynthesCareers

Required Skills

Communication, Corrective and Preventive Action (CAPA), Critical Thinking, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Mentorship, Network Optimization, Presentation Design, Process Optimization, Report Writing, Security Policies, Technical Credibility, Technologically Savvy, Training People, Vulnerability Assessments

Preferred Skills:

Communication, Corrective and Preventive Action (CAPA), Critical Thinking, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Mentorship, Network Optimization, Presentation Design, Process Optimization, Report Writing, Security Policies, Technical Credibility, Technologically Savvy, Training People, Vulnerability Assessments