Sr Principal, Cyber Policy & Culture

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com

As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function:

Technology Enterprise Strategy & Security

Job Sub Function:

Security & Controls

Job Category:

Scientific/Technology

All Job Posting Locations:

New Brunswick, New Jersey, United States of America, Palm Beach Gardens, Florida, United States of America, Raynham, Massachusetts, United States of America, Warsaw, Indiana, United States of America, West Chester, Pennsylvania, United States of America

Job Description:

DePuy Synthes is recruiting for a Sr. Principal, Governance and Policy, located in George Street New Brunswick NJ

Job Overview

The Senior Principal, Policy Governance & Cyber Culture is a strategic leadership role responsible for defining and driving the cyber policy, standards, and cyber culture strategy for DePuy Synthes. Reporting to the Director, GRC, this individual will serve as the authoritative leader for cybersecurity policy management, awareness, training, and stakeholder engagement, ensuring critical security controls are deeply embedded across product development, quality systems, commercial operations, manufacturing, and corporate functions.

The ideal candidate combines deep cybersecurity policy development expertise with strong business acumen, exceptional communication skills, and a proven ability to influence executive stakeholders and drive enterprise-wide behavioral change.

The Senior Principal will act as a trusted advisor to the CISO, Cyber GRC Senior Director & Director, and key stakeholders including, but not limited to, product security teams, regulatory affairs, quality, legal, privacy, and technology leaders, helping shape the organization's cyber policy & strategy and culture as it scales.

Strategic Leadership Responsibilities

Cyber Policy, Governance & Strategy

• Lead the development (authoring), implementation, and continuous evolution of the cyber policy and standards framework across DePuy Synthes.
• Establish governance processes that ensure cyber requirements are embedded across the product lifecycle, enterprise operations, and third-party ecosystem.
• Translate regulatory requirements, cybersecurity risks, and emerging threats into actionable business policies and controls.
• Develop strategic roadmaps that advance cyber governance maturity and support business growth objectives.
• Chair or support cyber policy development forums and working groups, driving accountability and decision-making across functions.
• Lead the strategy for policy exception, risk acceptance, and governance review processes.
• Benchmark organizational policies against industry-leading cybersecurity frameworks.

• Partner with Product Security leaders, as well asl leaders across R&D, Quality, and Regulatory Affairs to integrate cyber requirements into our secure product development lifecycle.
• Support cybersecurity readiness for regulatory submissions, inspections, and customer assessments.
• Serve as a key advisor on emerging regulatory requirements impacting DePuy Synthes and product security globally.
• Ensure cyber policy requirements evolve alongside emerging technologies, AI, regulatory expectations and the organization’s developing risk landscape.

Security Awareness, Education & Culture Leadership

Enterprise Cyber Culture Strategy

• Develop and execute a comprehensive cybersecurity awareness and culture strategy aligned to organizational risk priorities and business objectives.
• Transform awareness activities from compliance-focused training into a measurable behavior-change program.
• Design and execute realistic scenarios that stress-test cyber awareness and controls (i.e.: phishing sim program), including instant education, remediation training workflows and repeat offender tracking and escalation processes.
• Collaborate across Cyber to develop simulations informed by real-world threat intelligence, emerging attacker techniques and business relevant events.
• Support automation and tooling enhancement for simulation exercises.
• Analyze results to identify risk patterns and opportunities for targeted intervention.
• Partner with enterprise Learning & Development to design and implement annual cyber training.
• Establish and lead a global Cyber Champions network that drives cybersecurity engagement across business functions.

…