Strategic Cyber Governance & Policy Analyst

Johnson & Johnson Co.; New Brunswick (NJ); On-site; USD 79,000 - 142,000; Full time

Job summary

DePuy Synthes, a Johnson & Johnson company, is recruiting a Professional, Governance & Policy Analyst to lead cybersecurity policy, risk methods, and governance reporting. The role partners across IT, Legal, Privacy, Quality, Procurement, and business functions to strengthen risk-informed decision-making and cyber culture.

The analyst applies GRC frameworks, maintains the policy library, and supports third‑party risk oversight.

Qualifications

• 4+ years in cybersecurity governance, IT risk, or a related GRC discipline.
• Experience authoring and maintaining security policies, standards, and procedures within a governance lifecycle.
• Knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT.
• Experience supporting governance forums and producing leadership-ready reporting, metrics, and dashboards.
• Strong written communication skills and ability to influence stakeholders without direct authority.

Responsibilities

• Own the cybersecurity policy and standards library — authoring, reviewing, and maintaining policies, standards, procedures, and guidelines with lifecycle management.
• Maintain and improve cyber risk management framework and methodology including risk taxonomy and scoring criteria.
• Facilitate and document cyber risk assessments; track outcomes in the enterprise risk register and remediation activities.
• Administer the risk register as the single source of truth with ownership, aging analysis, and escalation.
• Coordinate governance forums (e.g., Cyber Risk Council) and prepare decision-ready materials.

Skills

GRC governance

IT risk management

Security policies

Risk assessments

Third-party risk

Regulatory/frameworks (NIST, ISO, COBn

Stakeholder communication

Education

Bachelor's degree in Information Technology / Cybersecurity / Information Systems

Master's degree in Cybersecurity / Information Systems / MBA preferred

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Power BI

Tableau

Job description

DePuy Synthes, a Johnson & Johnson company, is recruiting a Professional, Governance & Policy Analyst to lead cybersecurity policy, risk methods, and governance reporting. The role partners across IT, Legal, Privacy, Quality, Procurement, and business functions to strengthen risk-informed decision-making and cyber culture.

The analyst applies GRC frameworks, maintains the policy library, and supports third‑party risk oversight.