Sr Principal, Cyber Policy & Culture

Johnson & Johnson Innovative Medicine•New Brunswick, NJ

6d•Hybrid

About The Position

DePuy Synthes is recruiting a Senior Principal, Policy Governance & Cyber Culture, located at George Street in New Brunswick, New Jersey. This strategic leadership role defines and drives DePuy Synthes’ cyber policy, standards, and cyber culture strategy. Reporting to the Director, GRC, the role leads cybersecurity policy management, awareness, training, and stakeholder engagement, embedding critical security controls across product development, quality systems, commercial operations, manufacturing, and corporate functions. The Senior Principal advises the CISO, Cyber GRC Senior Director and Director, and stakeholders across product security, regulatory affairs, quality, legal, privacy, and technology. The role combines cybersecurity policy expertise, business acumen, communication, and the ability to influence executives and drive enterprise-wide behavioral change. The position leads the development and governance of cyber policies and standards; translates regulatory requirements, cybersecurity risks, and emerging threats into business policies and controls; advances governance maturity; and integrates cyber requirements into the secure product development lifecycle. It also leads enterprise awareness and culture programs, including scenario-based simulations, training, a global Cyber Champions network, executive engagement, and the annual Cyber Awareness Month. The role establishes metrics and reporting on program effectiveness and organizational cyber resilience, and advises executives and business stakeholders on cyber risk, regulatory expectations, and governance priorities.

Requirements

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Engineering, Information Technology, or a related discipline.
At least 10 years of demonstrated cybersecurity experience, including authoring cyber policies and maintaining security policies, standards, and procedures within a formal governance lifecycle.
At least 5 years leading enterprise cyber policy, awareness, or culture initiatives.
Working knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT.
Experience in a highly regulated industry such as medical devices, healthcare, life sciences, pharmaceuticals, or manufacturing.
Demonstrated success influencing senior executives and leading enterprise-wide change initiatives.
Strong understanding of the cyber regulatory landscape.
Exceptional written, verbal, presentation, and executive communication skills.
Ability to translate complex technical risks into clear business recommendations.

Nice To Haves

Business Process Design
Consulting
Crisis Management
Critical Thinking
Cyber Threat Intelligence
Information Security Auditing
Information Security Management System (ISMS)
Information Technology (IT) Security Assessments
Information Technology Strategies
Mentorship
Presentation Design
Process Optimization
Security Architecture Design
Security Policies
Tactical Planning
Technical Credibility
Vulnerability Management

Responsibilities

Lead the development, implementation, and continuous evolution of the cyber policy and standards framework across DePuy Synthes.
Establish governance processes that embed cyber requirements across the product lifecycle, enterprise operations, and third-party ecosystem.
Translate regulatory requirements, cybersecurity risks, and emerging threats into actionable business policies and controls.
Develop strategic roadmaps to advance cyber governance maturity and support business growth objectives.
Chair or support cyber policy forums and working groups, driving cross-functional accountability and decision-making.
Lead policy exception, risk acceptance, and governance review processes.
Benchmark organizational policies against leading cybersecurity frameworks.
Partner with Product Security, R&D, Quality, and Regulatory Affairs to integrate cyber requirements into the secure product development lifecycle.
Support cybersecurity readiness for regulatory submissions, inspections, and customer assessments.
Advise on emerging global regulatory requirements affecting DePuy Synthes and product security.
Ensure cyber policies evolve with emerging technologies, AI, regulatory expectations, and the organization’s risk landscape.
Develop and execute a cybersecurity awareness and culture strategy aligned with organizational risks and business objectives.
Turn compliance-focused awareness activities into a measurable behavior-change program.
Design and run realistic scenarios, including phishing simulations, instant education, remediation training workflows, and repeat-offender tracking and escalation.
Collaborate across Cyber to develop simulations informed by threat intelligence, attacker techniques, and business-relevant events.
Support automation and tooling enhancements for simulation exercises.
Analyze simulation results to identify risk patterns and opportunities for targeted intervention.
Partner with enterprise Learning & Development to design and implement annual cyber training.
Establish and lead a global Cyber Champions network.
Partner with business leaders to strengthen cybersecurity ownership and accountability.
Create executive engagement programs that improve senior leaders’ cyber risk awareness and decision-making.
Lead the annual Cyber Awareness Month strategy and engage the CISO and key stakeholders to amplify messages.
Define and monitor key performance indicators and maturity metrics for awareness and culture programs.
Measure employee behaviors, program effectiveness, and organizational cyber resilience using dashboards, surveys, simulations, and analytics.
Provide executive-level reporting and recommendations on culture maturity and security outcomes.
Advise executive leadership and business stakeholders on cybersecurity risk, regulatory expectations, and governance priorities.
Facilitate discussions and influence strategic decisions through clear risk communication and executive engagement.