Sr Principal, Cyber Policy & Culture

Johnson & Johnson•Brunswick, OH

4d•Hybrid

About The Position

DePuy Synthes is recruiting a Senior Principal, Governance and Policy, based at George Street in New Brunswick, New Jersey. This strategic leadership role defines and drives the organization’s cyber policy, standards, governance, and cyber culture strategy. Reporting to the Director, GRC, the role leads cybersecurity policy management, awareness, training, and stakeholder engagement, embedding security controls across product development, quality systems, commercial operations, manufacturing, and corporate functions. The position also advises the CISO, Cyber GRC senior leadership, and stakeholders across product security, regulatory affairs, quality, legal, privacy, and technology. The role leads the development, implementation, and continuous improvement of cyber policies and standards; establishes governance processes; translates regulatory requirements, risks, and emerging threats into actionable policies and controls; and advances governance maturity. It also partners with Product Security, R&D, Quality, and Regulatory Affairs to integrate cyber requirements into secure product development and support regulatory submissions, inspections, and customer assessments. The Senior Principal develops and executes a measurable enterprise cyber awareness and culture strategy, including realistic simulations, training and remediation workflows, a global Cyber Champions network, executive engagement, and Cyber Awareness Month. The role defines program metrics, analyzes behaviors and results, reports on culture maturity and security outcomes, and advises business leaders on cyber risk, regulatory expectations, and governance priorities.

Requirements

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Engineering, Information Technology, or a related discipline.
At least 10 years of demonstrated cybersecurity experience, including authoring cyber policies and maintaining security policies, standards, and procedures within a formal governance lifecycle.
At least 5 years leading enterprise cyber policy, awareness, or culture initiatives.
Working knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT.
Experience in a highly regulated industry such as medical devices, healthcare, life sciences, pharmaceuticals, or manufacturing.
Demonstrated success influencing senior executives and leading enterprise-wide change initiatives.
Strong understanding of the cyber regulatory landscape.
Exceptional written, verbal, presentation, and executive communication skills.
Ability to translate complex technical risks into clear business recommendations.

Nice To Haves

Business Process Design
Consulting
Crisis Management
Critical Thinking
Cyber Threat Intelligence
Information Security Auditing
Information Security Management System (ISMS)
Information Technology (IT) Security Assessments
Information Technology Strategies
Mentorship
Presentation Design
Process Optimization
Security Architecture Design
Security Policies
Tactical Planning
Technical Credibility
Vulnerability Management

Responsibilities

Lead the development, authoring, implementation, and continuous evolution of DePuy Synthes cyber policies and standards.
Establish governance processes that embed cyber requirements across the product lifecycle, enterprise operations, and third-party ecosystem.
Translate regulatory requirements, cybersecurity risks, and emerging threats into actionable business policies and controls.
Develop roadmaps to advance cyber governance maturity and support business growth objectives.
Chair or support policy forums and working groups, driving accountability and decision-making across functions.
Lead policy exception, risk acceptance, and governance review processes.
Benchmark policies against leading cybersecurity frameworks.
Partner with Product Security, R&D, Quality, and Regulatory Affairs to integrate cyber requirements into secure product development.
Support cybersecurity readiness for regulatory submissions, inspections, and customer assessments, and advise on emerging global regulatory requirements.
Ensure policy requirements evolve in response to emerging technologies, AI, regulatory expectations, and organizational risks.
Develop and execute an enterprise cybersecurity awareness and culture strategy aligned with risk priorities and business objectives.
Develop awareness activities into a measurable behavior-change program.
Design and execute realistic cyber scenarios and phishing simulations, including immediate education, remediation training, and repeat-offender tracking and escalation.
Collaborate with Cyber teams to develop simulations informed by threat intelligence, attacker techniques, and business-relevant events; support automation and tooling improvements.
Analyze simulation results to identify risk patterns and targeted intervention opportunities.
Partner with enterprise Learning & Development to design and implement annual cyber training.
Establish and lead a global Cyber Champions network and partner with business leaders to strengthen cybersecurity ownership and accountability.
Create executive engagement programs to improve senior leaders’ cyber risk awareness and decision-making.
Lead annual Cyber Awareness Month strategy and engage the CISO and stakeholders to amplify key messages.
Define and monitor awareness and culture KPIs and maturity metrics; measure employee behaviors, program effectiveness, and cyber resilience using dashboards, surveys, simulations, and analytics.
Provide executive-level reporting and recommendations on culture maturity and security outcomes.
Advise executive leadership and business stakeholders, facilitate discussions on cyber risk and governance, and influence strategic decisions through effective risk communication.