Sr Principal, Cyber Policy & Culture

Job description

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world.  We provide an inclusive work environment where each person is considered as an individual.  At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit. Job Function: Technology Enterprise Strategy & Security Job Sub Function: Security & Controls Job Category: Scientific/Technology All Job Posting Locations: New Brunswick, New Jersey, United States of America, Palm Beach Gardens, Florida, United States of America, Raynham, Massachusetts, United States of America, Warsaw, Indiana, United States of America, West Chester, Pennsylvania, United States of America Job Description: DePuy Synthes is recruiting for a Sr. Principal, Governance and Policy, located in George Street New Brunswick NJ Job Overview The Senior Principal, Policy Governance & Cyber Culture is a strategic leadership role responsible for defining and driving the cyber policy, standards, and cyber culture strategy for DePuy Synthes. Reporting to the Director, GRC, this individual will serve as the authoritative leader for cybersecurity policy management, awareness, training, and stakeholder engagement, ensuring critical security controls are deeply embedded across product development, quality systems, commercial operations, manufacturing, and corporate functions. The ideal candidate combines deep cybersecurity policy development expertise with strong business acumen, exceptional communication skills, and a proven ability to influence executive stakeholders and drive enterprise-wide behavioral change. The Senior Principal will act as a trusted advisor to the CISO, Cyber GRC Senior Director & Director, and key stakeholders including, but not limited to, product security teams, regulatory affairs, quality, legal, privacy, and technology leaders, helping shape the organization's cyber policy & strategy and culture as it scales. Strategic Leadership Responsibilities Cyber Policy, Governance & Strategy Lead the development (authoring), implementation, and continuous evolution of the cyber policy and standards framework across DePuy Synthes. Establish governance processes that ensure cyber requirements are embedded across the product lifecycle, enterprise operations, and third-party ecosystem. Translate regulatory requirements, cybersecurity risks, and emerging threats into actionable business policies and controls. Develop strategic roadmaps that advance cyber governance maturity and support business growth objectives. Chair or support cyber policy development forums and working groups, driving accountability and decision-making across functions. Lead the strategy for policy exception, risk acceptance, and governance review processes. Benchmark organizational policies against industry-leading cybersecurity frameworks. Partner with Product Security leaders, as well asl leaders across R&D, Quality, and Regulatory Affairs to integrate cyber requirements into our secure product development lifecycle. Support cybersecurity readiness for regulatory submissions, inspections, and customer assessments. Serve as a key advisor on emerging regulatory requirements impacting DePuy Synthes and product security globally. Ensure cyber policy requirements evolve alongside emerging technologies, AI, regulatory expectations and the organization’s developing risk landscape. Security Awareness, Education & Culture Leadership Enterprise Cyber Culture Strategy Develop and execute a comprehensive cybersecurity awareness and culture strategy aligned to organizational risk priorities and business objectives. Transform awareness activities from compliance-focused training into a measurable behavior-change program. Design and execute realistic scenarios that stress-test cyber awareness and controls (i.e.: phishing sim program), including instant education, remediation training workflows and repeat offender tracking and escalation processes. Collaborate across Cyber to develop simulations informed by real-world threat intelligence, emerging attacker techniques and business relevant events. Support automation and tooling enhancement for simulation exercises. Analyze results to identify risk patterns and opportunities for targeted intervention. Partner with enterprise Learning & Development to design and implement annual cyber training. Establish and lead a global Cyber Champions network that drives cybersecurity engagement across business functions. Partner with business leaders to strengthen cybersecurity ownership and accountability at all levels of the organization. Create executive engagement programs that improve cyber risk awareness and decision making among senior leaders. Lead the development and strategy for Cyber Awareness Month on an annual basis; engaging the CISO and key stakeholders to support and amplify key messages to strengthen cyber culture. Measurement & Reporting Define and monitor key performance indicators and maturity metrics for awareness and culture programs. Measure employee behaviors, program effectiveness, and organizational cyber resilience using dashboards, surveys, simulations, and analytics. Provide executive-level reporting and recommendations on culture maturity and security outcomes. Risk & Stakeholder Management Serve as a trusted cybersecurity advisor to executive leadership and key business stakeholders. Facilitate discussions regarding cyber risk, regulatory expectations, and governance priorities. Influence strategic decisions through effective risk communication and executive engagement. Required Qualifications Bachelor's degree in Cybersecurity, Information Security, Computer Science, Engineering, Information Technology, or related discipline. 10+ years of demonstrated cybersecurity experience, including policy development, specifically authoring cyber policies and maintaining security policies, standards, and procedures within a formal governance lifecycle. 5+ years leading enterprise cyber policy, awareness, or culture initiatives. Working knowledge of leading frameworks including NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT. Experience operating within highly regulated industries such as Medical Devices, Healthcare, Life Sciences, Pharmaceuticals, or Manufacturing. Demonstrated success in influencing senior executives and leading enterprise-wide change initiatives. Strong understanding of the cyber regulatory landscape. Exceptional written, verbal, presentation, and executive communication skills. Proven ability to translate complex technical risks into clear business recommendations. For more information on how we support the whole health of our employees throughout their wellness, career and life journey, please visit www.careers.jnj.com. Johnson & Johnson announced plans to separate our Orthopaedics business to establish a standalone orthopaedics company, operating as DePuy Synthes. The process of the planned separation is anticipated to be completed within 18 to 24 months, subject to legal requirements, including consultation with works councils and other employee representative bodies, as may be required, regulatory approvals and other customary conditions and approvals. Should you accept this position, it is anticipated that, following conclusion of the transaction, you would be an employee of DePuy Synthes and your employment would be governed by DePuy Synthes employment processes, pr