Professional Governance & Policy Analyst

Johnson & Johnson MedTech; West Chester (Chester County); On-site; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson is seeking a Professional, Governance & Policy Analyst within DePuy Synthes to design, maintain, and operationalize the cybersecurity policy framework and risk governance model. This individual contributor role partners with IT, Legal, Privacy, Quality, Procurement, and business units to strengthen risk-informed decisions and cyber culture.

Responsibilities include managing the policy library, risk register, and executive reporting, while aligning controls with NIST, ISO,

Qualifications

• 4+ years of experience in cybersecurity governance, IT risk management, technology compliance, or a related GRC discipline.
• Demonstrated experience authoring and maintaining security policies, standards, and procedures within a formal governance lifecycle.
• Working knowledge of leading frameworks including NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT.
• Hands-on experience conducting risk assessments and maintaining a risk register, including risk scoring, treatment planning, and remediation tracking.
• Experience supporting governance forums and producing leadership-ready reporting, metrics, and dashboards.

Responsibilities

• Own the cybersecurity policy and standards library — authoring, reviewing, and maintaining policies, standards, procedures, and guidelines on a defined lifecycle, including annual attestation and exception management.
• Maintain the cyber risk management framework and methodology, including risk taxonomy, scoring criteria, risk appetite thresholds, and treatment/acceptance workflows.
• Facilitate and document cyber risk assessments across applications, infrastructure, business processes, and change initiatives; capture outcomes in the enterprise risk register and track remediation to closure.
• Administer the risk register as the single source of truth — ensuring completeness, accuracy, ownership assignment, aging analysis, and timely escalation of overdue or elevated risks.
• Coordinate cybersecurity governance forums (e.g., Cyber Risk Council, steering committees), including agenda development, materials preparation, decision logging, and action item follow-through.
• Develop and publish executive and operational reporting packages that translate technical risk data into clear business impact narratives for CIO, CISO, and leadership audiences.
• Map policy and control requirements to external frameworks and regulations (NIST CSF, ISO 27001, HIPAA, GDPR, FDA premarket/postmarket cybersecurity guidance) and maintain crosswalk documentation.

Skills

Cybersecurity governance

IT risk management

Policy writing

GRC frameworks

Third-party risk

Security reporting

Education

Bachelor's degree in Information Technology/Cybersecurity

Master's degree in Cybersecurity/Information Systems

Tools

Power BI

Job description

At Johnson & Johnson,we believe health is everything. Our strength in healthcare innovation empowers us to build aworld where complex diseases are prevented, treated, and cured,where treatments are smarter and less invasive, andsolutions are personal.Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity.Learn more at jnj.com

As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function

Technology Enterprise Strategy & Security

Job Sub Function

Security & Controls

Job Category

Scientific/Technology

All Job Posting Locations

New Brunswick, New Jersey, United States of America, Palm Beach Gardens, Florida, United States of America, Raritan, New Jersey, United States of America, Raynham, Massachusetts, United States of America, Warsaw, Indiana, United States of America, West Chester, Pennsylvania, United States of America

Job Description

DePuy Synthes is recruiting for a(n) Professional, Governance & Policy Analyst.

The Professional, Governance & Policy Analyst is an established and productive individual contributor within the Cybersecurity function, GRC, IT Controls & Cyber Culture sub-function, accountable for the design, maintenance, and operationalization of the cybersecurity policy framework, risk methodology, and governance reporting model for DePuy Synthes. This role owns the cyber policy and standards library, administers the enterprise cyber risk register and assessment lifecycle, coordinates governance forums and executive reporting, and supports third-party risk oversight. Working under moderate supervision, the analyst applies practical knowledge of GRC frameworks to translate regulatory expectations into clear, actionable standards, and partners across IT, Legal, Privacy, Quality, Procurement, and business functions to strengthen risk-informed decision-making and a strong cyber culture.

Key Responsibilities

• Own the cybersecurity policy and standards library — authoring, reviewing, and maintaining policies, standards, procedures, and guidelines on a defined lifecycle, including annual attestation and exception management.
• Maintain and continuously improve the cyber risk management framework and methodology, including risk taxonomy, scoring criteria, risk appetite thresholds, and treatment/acceptance workflows.
• Facilitate and document cyber risk assessments across applications, infrastructure, business processes, and change initiatives; capture outcomes in the enterprise risk register and track remediation to closure.
• Administer the risk register as the single source of truth — ensuring completeness, accuracy, ownership assignment, aging analysis, and timely escalation of overdue or elevated risks.
• Coordinate cybersecurity governance forums (e.g., Cyber Risk Council, steering committees), including agenda development, materials preparation, decision logging, and action item follow-through.
• Develop and publish executive and operational reporting packages that translate technical risk data into clear business impact narratives for CIO, CISO, and leadership audiences.
• Design, baseline, and report on cyber risk metrics and Key Risk Indicators (KRIs), establishing thresholds and trend analysis to drive proactive risk management.
• Support third-party and vendor cyber risk oversight — including risk tiering, security questionnaire review, SOC 2 / ISO 27001 evidence evaluation, contractual security requirements, and ongoing monitoring of critical suppliers.
• Map policy and control requirements to external frameworks and regulations (NIST CSF, ISO 27001, HIPAA, GDPR, FDA premarket/postmarket cybersecurity guidance) and maintain crosswalk documentation to reduce duplicative control effort.
• Partner with the IT Controls and SOX teams to align governance requirements with control design, avoiding gaps and redundancy across the assurance landscape.
• Drive cyber culture and awareness initiatives — developing policy communications, training content, and targeted enablement to increase understanding and adoption across the enterprise.
• Assess the governance impact of technology change, including system implementations, cloud migrations, and separation/carve-out activity, and define policy and risk requirements ahead of go‑live.
• Support internal and external audit, regulatory inquiries, and customer security assessments by providing governance documentation, evidence, and coordinated responses.
• Identify opportunities to automate GRC workflows, reporting, and evidence collection to improve efficiency and data quality.

Qualifications

Education

• Bachelor's degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business, or a related discipline.
• Master's degree in Cybersecurity, Information Systems, or Business Administration preferred

Required

Experience and Skills

• 4+ years of experience in cybersecurity governance, IT risk management, technology compliance, or a related GRC discipline.
• Demonstrated experience authoring and maintaining security policies, standards, and procedures within a formal governance lifecycle.
• Working knowledge of leading frameworks including NIST CSF, NIST 800‑53, ISO 27001/27002, and COBIT.
• Hands‑on experience conducting risk assessments and maintaining a risk register, including risk scoring, treatment planning, and remediation tracking.
• Experience supporting governance forums and producing leadership‑ready reporting, metrics, and dashboards.
• Familiarity with third‑party/vendor risk assessment processes and review of SOC 2 / ISO certifications.
• Strong written communication skills, with the ability to translate technical risk into clear business language and influence stakeholders without direct authority.

Preferred

• MedTech, Life Sciences, or other regulated industry experience; familiarity with HIPAA, GDPR, and FDA medical device cybersecurity expectations.
• Experience establishing or maturing a GRC function within a divestiture, carve‑out, spin‑off, or standalone entity stand‑up.
• Hands‑on experience with GRC platforms (e.g., ServiceNow IRM, Archer, OneTrust, AuditBoard) and workflow configuration.
• Experience defining and operationalizing KRIs and risk appetite statements at an enterprise level.
• Exposure to cloud governance (AWS, Azure) and control expectations for SaaS and cloud‑hosted environments.
• Proficiency with data visualization and reporting tools (Power BI, Tableau) for risk metrics and executive dashboards.
• Experience applying Generative AI / LLM‑enabled tooling to accelerate policy drafting, control mapping, and third‑party questionnaire review.
• Experience developing security awareness and cyber culture programs.

Other

• Travel: Up to 15% domestic travel expected across DePuy Synthes sites.
• Language: English proficiency required.
• Certifications: CISSP, CRISC, CISM, CISA, CGRC (formerly CAP), or ISO 27001 Lead Implementer/Auditor preferred.

For more information on how we support the whole health of our employees throughout their wellness, career and life journey, please visit www.careers.jnj.com.

Johnson & Johnson announced plans to separate our Orthopaedics business to establish a standalone orthopaedics company, operating as DePuy Synthes. The process of the planned separation is anticipated to be completed within 18 to 24 months, subject to legal requirements, including consultation with works councils and other employee representative bodies, as may be required, regulatory approvals and other customary conditions and approvals. Should you accept this position, it is anticipated that, following conclusion of the transaction, you would be an employee of DePuy Synthes and your employment would be governed by DePuy Synthes employment processes, programs, policies, and benefit plans. In that case, details of any planned changes would be provided to you by DePuy Synthes at an appropriate time and subject to any necessary consultation processes.

Johnson & Johnson is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or other characteristics protected by federal, state or local law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act.

Johnson & Johnson is committed to providing an interview process that is inclusive of our applicants’ needs. If you are an individual with a disability and would like to request an accommodation, external applicants please contact us via https://www.jnj.com/contact-us/careers, internal employees contact AskGS to be directed to your accommodation resource.

Required Skills

Analytical Reasoning, Communication, Corrective and Preventive Action (CAPA), Industry Analysis, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Mentorship, Process Oriented, Risk Assessments, Root Cause Analysis (RCA), Security Policies, Solution Architecture, Technologically Savvy, Vulnerability Assessments

Preferred Skills

Analytical Reasoning, Communication, Corrective and Preventive Action (CAPA), Industry Analysis, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Mentorship, Process Oriented, Risk Assessments, Root Cause Analysis (RCA), Security Policies, Solution Architecture, Technologically Savvy, Vulnerability Assessments

The anticipated base pay range for this position is :

79,000.00 - 142,000.00 USD Annual

Additional Description For Pay Transparency

• Vacation –120 hours per calendar year
• Sick time - 40 hours per calendar year; for employees who reside in the State of Colorado –48 hours per calendar year; for employees who reside in the State of Washington –56 hours per calendar year
• Holiday pay, including Floating Holidays –13 days per calendar year
• Work, Personal and Family Time - up to 40 hours per calendar year
• Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child
• Bereavement Leave – 240 hours for an immediate family member: 40 hours for an extended family member per calendar year
• Caregiver Leave – 80 hours in a 52-week