Manager, Information Security Policy & Governance

Johnson & Johnson is currently recruiting for a Manager, Information Security Policy & Governance within its Information Security and Risk Management (ISRM) group. The preferred candidate will be based in Raritan, NJ but we will consider candidates near a Johnson and Johnson office in North America. This position may require up to 5% travel. Remote work options may be considered on a case-by-case basis and if approved by the Company. Johnson & Johnson, through its operating companies, is the world's most comprehensive and broadly-based manufacturer of health care products, as well as a provider of related services, for the consumer, pharmaceutical, and medical devices and diagnostics markets. We strive to provide scientifically sound, high-quality products and services to help heal, cure disease and improve the quality of life. Thriving on a diverse company culture, celebrating the uniqueness of our employees and committed to inclusion. Proud to be an equal opportunity employer. The Manager, Information Security Policy & Governance will be responsible for the management of enterprise information security policies and standards throughout their entire lifecycle. They will be the enterprise domain authority on policy interpretation and will ensure that the policies and standards are aligned with enterprise risk, current technology capabilities, and regulatory requirements. The role also serves as the domain authority for ensuring appropriate security requirements are included in vendor and partner agreements. Key Responsibilities: Manage, maintain, and improve Information Security & Risk Management policies and standards, including collaboration with SMEs on policy statement generation/revision as appropriate. Support external third-party assessment requests of J&J’s risk and security profile. Serve as an SME for ensuring information security requirements are included in contracts during negotiations. Maintain currency with regulatory frameworks such as ISO 27001:2022, NIST Cybersecurity Framework, and other strategic frameworks, as well as with other compliance focused frameworks like HITRUST. Ensure the enterprise policies and standards accurately reflect the interpreted scope of those frameworks. Lead migration of policy set to GRC platform, including requirements management, process development and ongoing post implementation activities. Perform other work-related duties as assigned. Qualifications Required: A minimum of a Bachelor’s degree A minimum of 8 years of overall experience in IT and/or information security and risk management, of which a minimum of 5 years’ experience must be in the information security field. Experience with policy generation and/or implementation within a large enterprise Solid grasp of information security concepts and controls Extensive knowledge of standards and regulatory frameworks like ISO 27001, NIST Cybersecurity Framework, HITRUST, etc. Excellent writing skills and the ability to convey complex requirements to an international audience. Excellent communication and collaboration skills, able to network, influence at all levels of the organization, cross sector, cross-functionally and globally Strong leadership skills Preferred: CISSP or other Information Security or Risk Management certifications are a plus. For U.S. applicants, in accordance with applicable disclosure requirements, the anticipated base pay range for this position is $93,000 to $139,000. The Company maintains highly competitive, performance-based compensation programs. Under current guidelines, this position is eligible for an annual performance bonus in accordance with the terms of the applicable plan. The annual performance bonus is a cash bonus intended to provide an incentive to achieve annual targeted results by rewarding for individual and the corporation’s performance over a calendar/ performance year. Bonuses are awarded at the Company’s discretion on an individual basis. Employees may be eligible to participate in Company employee benefit programs such as health insurance, savings plan, pension plan, disability plan, long-term incentive, vacation pay, sick time, holiday pay, and work, personal and family time off in accordance with the terms of the applicable plans. Additional information can be found through the link below. For additional general information on company benefits, please go to: - https://www.careers.jnj.com/employee-benefits
ISRM Primary Location United States-New Jersey-Raritan-1000 US HIghway 202 Other Locations North America-Canada, North America-United States Organization Johnson & Johnson Services Inc. (6090) Job Function Info Technology Requisition ID 2206034097W