Strategic Cyber GRC Analyst

6090-Johnson & Johnson Services Inc. Legal Entity; New Brunswick (NJ); Hybrid; USD 79,000 - 142,000; Full time

Job summary

Johnson & Johnson's DePuy Synthes Cybersecurity Governance & Policy team is hiring a Professional, Governance & Policy Analyst. You will own the cybersecurity policy framework, manage risk assessments, and produce leadership-ready reporting for CIO/CISO and senior leaders.

The role requires strong governance experience across NIST/ISO frameworks, and collaboration with Legal, Privacy, Quality, and Procurement across multiple sites.

Qualifications

• Bachelor’s degree in Information Technology, Cybersecurity, Information Systems, Risk Management, Business or related discipline.
• Master’s degree in Cybersecurity, Information Systems, or Business Administration preferred.
• 4+ years in cybersecurity governance, IT risk management, technology compliance, or related GRC discipline.

Responsibilities

• Own cybersecurity policy and standards library; author, review, maintain policies, standards, procedures, guidelines.
• Maintain cyber risk management framework incl. risk taxonomy, scoring, appetite thresholds, treatment workflows.
• Facilitate cyber risk assessments across applications, infrastructure, processes, changes; record in enterprise risk register.
• Manage risk register as single source of truth; ensure completeness, ownership, aging, escalation.
• Coordinate governance forums; prepare materials, log decisions, track actions.
• Develop executive/operational reporting translating risk data into business impact narratives.
• Design/report cyber risk metrics and KRIs; monitor thresholds and trends.
• Support third-party/vendor risk oversight with SOC 2/ISO evidence reviews.
• Map policy to NIST CSF, ISO 27001, HIPAA, GDPR, FDA cybersecurity guidance.
• Partner with IT Controls and SOX to align governance with controls.
• Drive policy communications and cyber culture initiatives across the enterprise.

Skills

Analytical reasoning

Communication

CAPA

Industry analysis

Information security auditing

ISMS

SOC 2/ISO

IT risk management

Risk assessments

Policy development

Vulnerability assessments

Solution architecture

Education

Bachelor’s degree in IT, Cybersecurity, Information Systems, Risk Management, Business

Master’s degree preferred

Tools

ServiceNow IRM

Archer

OneTrust

AuditBoard

Job description

Johnson & Johnson's DePuy Synthes Cybersecurity Governance & Policy team is hiring a Professional, Governance & Policy Analyst. You will own the cybersecurity policy framework, manage risk assessments, and produce leadership-ready reporting for CIO/CISO and senior leaders.

The role requires strong governance experience across NIST/ISO frameworks, and collaboration with Legal, Privacy, Quality, and Procurement across multiple sites.