Senior Manager, Pre-Close Security

Johnson & Johnson•Raritan, NJ

About The Position

The Senior Manager, Information Security Risk Management (ISRM) Acquisitions & Divestitures (A&D) Cybersecurity, Pre-Close, is a hands-on cybersecurity Deal Lead for due diligence involving mergers, acquisitions, divestitures, licensing arrangements, minority investments, and strategic partnerships. Reporting to the Director, ISRM A&D Cybersecurity, Pre-Close, the role leads transaction-level cybersecurity assessments, interprets diligence evidence, identifies material technical and regulatory concerns, and supports risk-informed decisions before close. The role evaluates target environments across enterprise cybersecurity and technology domains, challenges assumptions, investigates complex issues, and recommends practical mitigations. It works with Corporate Development, Legal, Privacy, Finance, Technology Services, ISRM capability and policy owners, business technology leaders, external advisors, and transaction teams to document and escalate risks, clarify enterprise requirements and Day 1 priorities, and prepare findings for post-close execution. The position also contributes to diligence methods and reporting improvements, and provides guidance to managers, analysts, advisors, and other contributors. Remote work may be considered case by case and requires Company approval.

Requirements

Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related discipline.
8+ years of progressive experience in cybersecurity, information risk management, technology delivery, security architecture, M&A transaction support, due diligence, integration or separation, or related disciplines.
Demonstrated experience leading or materially supporting cybersecurity due diligence, acquisition or divestiture assessments, third-party security reviews, or complex risk assessments in time-sensitive business environments.
Strong technical background across security architecture, identity and access management, cloud and infrastructure security, endpoint and network security, application security, data protection, vulnerability management, incident response, logging and monitoring, third-party risk, and cyber resilience.
Ability to analyze incomplete or fragmented evidence, identify risk themes, ask effective follow-up questions, troubleshoot technical ambiguity, and distinguish material transaction risks from routine operational findings.
Experience translating technical cybersecurity findings into business-focused recommendations, risk narratives, remediation priorities, Day 1 considerations, contractual inputs, and post-close handoff requirements.
Working knowledge of privacy, legal, regulatory, and enterprise security obligations relevant to healthcare, MedTech, pharmaceutical, manufacturing, or other regulated global environments.
Strong understanding of cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO 27001, NIST 800-series publications, GDPR, HIPAA, and other applicable requirements.
Experience coordinating multiple workstreams, stakeholders, vendors, advisors, and deadlines across concurrent deals or complex programs.
Excellent written and verbal communication skills, including communicating technical risk, business impact, unresolved assumptions, and decision needs to technical and non-technical audiences.
Ability to operate with confidentiality, urgency, sound judgment, and professionalism in ambiguous, high-pressure transaction environments.

Nice To Haves

Advanced degree (MBA, MS, or equivalent).
Experience as a cybersecurity Deal Lead or workstream lead for acquisitions, divestitures, licensing transactions, minority investments, strategic partnerships, or joint ventures.
Experience developing or operating A&D cybersecurity diligence playbooks, questionnaires, control libraries, risk-scoring methods, issue logs, decision records, RACI models, and handoff criteria.
Experience with outside-in cyber assessments, threat exposure reviews, breach history analysis, vendor risk analysis, or technical architecture reviews for transaction diligence.
Experience partnering with Corporate Development, Legal, Privacy, Finance, Technology Services, business technology teams, IMO/SMO functions, ISRM capability owners, external advisors, and managed service providers.
Experience in regulated healthcare, pharmaceutical, MedTech, manufacturing, life sciences, or similarly complex global environments.
Relevant certifications such as CISSP, CISM, CRISC, CISA, CCSP, CCSK, or equivalent credentials.
Experience contributing to standardized diligence methods, templates, reporting, automation, metrics, and lessons learned across an A&D cybersecurity portfolio.

Responsibilities

Lead assigned pre-close cybersecurity due diligence, coordinating activities, timelines, evidence needs, and clear documentation of findings for deal teams and leadership.
Assess target environments across security architecture, identity, network, endpoint, cloud, application security, data protection, vulnerability management, incident response, third-party risk, and cyber resilience; identify material risks, control gaps, remediation needs, and integration or separation implications.
Lead questionnaire reviews, management meeting preparation, outside-in assessment coordination, documentation analysis, follow-up inquiries, advisor engagement, and evidence consolidation.
Translate technical findings into business-focused recommendations regarding risk acceptance, contractual protections, closing conditions, Day 1 priorities, remediation costs, integration dependencies, and post-close commitments.
Coordinate with transaction stakeholders and deal sponsors to align expectations, resolve open questions, and escalate material risks through the Director and appropriate governance channels.
Convert diligence findings into Day 1 objectives, minimum security expectations, TSA considerations, risk register entries, dependency tracking, and handoff materials for post-close integration or separation.
Improve diligence playbooks, questionnaires, risk taxonomies, scoring methods, templates, dashboards, reporting routines, intake workflows, and evidence standards.
Guide managers, analysts, advisors, and cross-functional contributors; promote accountability, mentoring, lessons learned, and consistent use of approved A&D cybersecurity methods.

Benefits

Consolidated retirement plan (pension) and savings plan (401(k)), subject to plan terms.
Vacation: 120 hours per calendar year, subject to policy and date of hire.
Sick time: 40 hours per calendar year; Colorado residents: 48 hours; Washington residents: 56 hours, subject to policy and date of hire.
Holiday pay, including floating holidays: 13 days per calendar year.
Work, Personal and Family Time: up to 40 hours per calendar year.
Parental Leave: 480 hours within one year of the birth, adoption, or foster care of a child.
Bereavement Leave: 240 hours for an immediate family member and 40 hours for an extended family member per calendar year.
Caregiver Leave: 80 hours in a 52-week rolling period.
Volunteer Leave: 32 hours per calendar year.
Military Spouse Time-Off: 80 hours per calendar year.
For additional general information on Company benefits, please go to: https://www.careers.jnj.com/employee-benefits