A&D Pre-Close Security Director

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit. Job Function: Technology Enterprise Strategy & Security Job Sub Function: Security & Controls Job Category: People Leader All Job Posting Locations: Alabama (Any City), Alabama (Any City), Alaska (Any City), Arizona (Any City), Arkansas (Any City), California (Any City), Connecticut (Any City), Delaware (Any City), Florida (Any City), Georgia (Any City), Hawaii (Any City), Idaho (Any City), Illinois (Any City), Indiana (Any City), Kansas (Any City), Kentucky (Any City), Louisiana (Any City), Maine (Any City), Maryland (Any City), Massachusetts (Any City), Michigan (Any City), Minnesota (Any City), Mississippi (Any City), Missouri (Any City), Montana (Any City) {+ 24 more} Job Description The Director, Information Security Risk Management (ISRM) Acquisitions & Divestitures (A&D) Cybersecurity, Pre-Close, serves as the strategic leader responsible for defining, governing, and continuously improving the enterprise cybersecurity approach for pre-close mergers, acquisitions, divestitures, licensing arrangements, minority investments, and strategic partnerships. This role provides executive leadership and oversight for cybersecurity due diligence, transaction risk management, deal security governance, and integration or separation readiness. The Director applies comprehensive regulatory and compliance insight together with broad technical expertise across cybersecurity and enterprise technology to challenge assumptions, troubleshoot complex deal issues, make risk-informed decisions, and preserve security-by-design principles throughout transaction planning. The Director partners closely with Corporate Development, Legal, Privacy, Finance, Technology Services, ISRM capability and policy owners, business technology leaders, transaction teams, and senior executives to ensure cyber risks and enterprise policy requirements are incorporated into deal decisions, contractual protections, Day 1 priorities, integration and separation plans, and post-close commitments.

• Strategic Leadership, Policy Alignment & Governance: Establish and govern the pre-close cybersecurity strategy, operating model, decision framework, standards, and escalation paths. Partner with key ISRM policy, capability, architecture, risk, and control stakeholders to ensure enterprise requirements are reflected in integration and separation plans and addressed through approved exception processes where necessary.
• Cybersecurity Due Diligence Leadership: Lead the enterprise cybersecurity due diligence program by defining assessment methods, evidence requirements, regulatory and control criteria, reporting standards, and quality expectations. Provide executive oversight of internal and third-party assessments.
• Transaction Risk & Technical Decision Support: Evaluate material cyber risks, incidents, regulatory exposure, control gaps, architecture choices, technology dependencies, and remediation obligations. Troubleshoot complex issues and advise transaction sponsors on risk acceptance, contractual protections, closing conditions, security-by-design requirements, Day 1 priorities, and post-close commitments.
• Integration & Separation Readiness: Translate diligence findings, enterprise policy requirements, and deal structure into risk-based Day 1 objectives, minimum controls, transition assumptions, TSA considerations, dependency tracking, and clear handoff requirements for post-close execution.
• Portfolio Leadership & Resource Prioritization: Oversee the global pre-close transaction portfolio and prioritize resources based on deal value, threat, complexity, regulatory impact, and timing.
• Executive Engagement & Communication: Communicate findings, regulatory implications, recommendations, residual risk, decisions, and business impacts to executives, governance boards, steering committees, and transaction sponsors.
• Process, Data & Automation Improvement: Standardize intake, questionnaires, risk taxonomies, scoring, evidence, dashboards, metrics, templates, and workflow automation to improve speed, traceability, consistency, and portfolio visibility.
• Organizational Leadership: Lead and develop managers, cybersecurity professionals, deal leads, and cross-functional contributors while promoting accountability, mentoring, knowledge sharing, and consistent use of approved playbooks and governance practices. Qualifications Education
• Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related discipline.
• Advanced degree (MBA, MS, or equivalent) preferred. Required Experience & Skills
• 12+ years of progressive experience in cybersecurity, information risk management, technology leadership, M&A transaction support, integration or separation, or related disciplines.
• Demonstrated experience leading cybersecurity programs supporting acquisitions, divestitures, licensing, minority investments, strategic partnerships, or other complex business transactions.
• Comprehensive regulatory and compliance insight, including the ability to interpret applicable legal, privacy, industry, and enterprise obligations and translate them into practical transaction requirements, control decisions, and risk treatment.
• Broad technical expertise across security architecture, identity and access management, cloud and infrastructure security, endpoint security, network security, application security, data protection, vulnerability management, security operations, incident response, third-party risk, privacy, and cyber resilience.
• Demonstrated ability to troubleshoot complex cybersecurity and technology issues at a Director level, challenge technical assumptions and proposed solutions, make key risk-informed decisions, and preserve security-by-design principles throughout transaction planning and execution.
• Proven ability to partner with ISRM policy, capability, architecture, risk, and control owners to reconcile enterprise security requirements with transaction constraints and keep integration and separation plans aligned with approved policies, standards, control objectives, and exception processes.
• Experience influencing executives and driving cross-functional initiatives across highly matrixed, global environments.
• Strong understanding of recognized cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO 27001, NIST 800-series publications, GDPR, HIPAA, and other applicable requirements.
• Experience managing portfolios involving concurrent deals, assessments or workstreams, vendors, senior stakeholders, dependencies, and time-sensitive decisions.
• Exceptional executive communication and presentation skills, with the ability to articulate technical risk, regulatory implications, business impact, residual exposure, and decision needs to non-technical audiences.
• Demonstrated ability to navigate ambiguity, protect transaction confidentiality, drive organizational change, and improve repeatability through data, tools, automation, and disciplined governance. Preferred Experience
• Experience developing or operating A&D cybersecurity playbooks, questionnaires, control libraries, risk-scoring methods, RACI models, handoff criteria, and phase-based transaction standards.
• Experience designing automation for intake, evidence collection, risk reporting, workflow orchestration, dashboards, and portfolio governance.
• Experience partnering with Corporate Development, Legal, Privacy, Finance, Technology Services, business technology teams, IMO/SMO functions, external advisors, and managed service providers.
• Experience in regulated healthcare, pharmaceutical, MedTech, manufacturing, or similarly complex global environments.
• Relevant certifications such as CISSP, CISM, CRISC, CISA, CCSK, or equivalent credentials preferred. Leadership Expectations
• Operates as an enterprise-minded cybersecurity leader who balances transaction speed, regulatory and enterprise obligations, technical risk, stakeholder expectations, operational continuity, and value realization.
• Maintains security by design through clear technical direction, informed challenge, disciplined governance, and partnership with enterprise policy and capability owners.
• Builds repeatable systems rather than one-time solutions, emphasizing scalability, measurable outcomes, traceability, and continuous improvement.
• Drives accountability by defining ownership, escalation paths, decision rights, quality standards, and delivery expectations.
• Creates an inclusive, collaborative environment that encourages mentoring, knowledge sharing, pragmatic risk management, and high-quality execution. An internal pre-identified candidate for consideration has been identified. However, all applications will be considered. Remote work options may be considered on a case-by-case basis and if approved by the Company. Johnson & Johnson is an All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status or other characteristics protected by federal, state or local law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act. Johnson & Johnson is committed to providing an interview process that is inclusive of our applicants’ needs. If you are an individual with a disability and would like to request an accommodation, please contact us via https://www.jnj.com/contact-us/careers or contact AskGS to be directed to your accommodation resource. Required Skills: Preferred Skills: Business Process Design, Creating Purpose, Crisis Management, Critical Thinking, Cybersecurity, Developing Others, Inclusive Leadership, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Leadership, Organizing, People Performance Management, Presentation Design, Process Optimization, Security Architecture Design, Security Policies The anticipated base pay range for this position is : $150,000.00 - $258,750.00 Additional Description for Pay Transparency: Subject to the terms of their respective plans, employees are eligible to participate in the Company’s consolidated retirement plan (pension) and savings plan (401(k)). This position is eligible to participate in the Company’s long-term incentive program. Subject to the terms of their respective policies and date of hire, employees are eligible for the following time off benefits Vacation –120 hours per calendar year Sick time - 40 hours per calendar year; for employees who reside in the State of Colorado –48 hours per calendar year; for employees who reside in the State of Washington –56 hours per calendar year Holiday pay, including Floating Holidays –13 days per calendar year Work, Personal and Family Time - up to 40 hours per calendar year Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child Bereavement Leave – 240 hours for an immediate family member: 40 hours for an extended family member per calendar year Caregiver Leave – 80 hours in a 52-week rolling period10 days Volunteer Leave – 32 hours per calendar year Military Spouse Time-Off – 80 hours per calendar year Additional information can be found through the link below. The following link to general company benefits information MUST also be included in the posting: Please use the following language: For additional general information on Company benefits, please go to: - https://www.careers.jnj.com/employee-benefits

Education • Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related discipline. Required Experience & Skills • 12+ years of progressive experience in cybersecurity, information risk management, technology leadership, M&A transaction support, integration or separation, or related disciplines. • Demonstrated experience leading cybersecurity programs supporting acquisitions, divestitures, licensing, minority investments, strategic partnerships, or other complex business transactions. • Comprehensive regulatory and compliance insight, including the ability to interpret applicable legal, privacy, industry, and enterprise obligations and translate them into practical transaction requirements, control decisions, and risk treatment. • Broad technical expertise across security architecture, identity and access management, cloud and infrastructure security, endpoint security, network security, application security, data protection, vulnerability management, security operations, incident response, third-party risk, privacy, and cyber resilience. • Demonstrated ability to troubleshoot complex cybersecurity and technology issues at a Director level, challenge technical assumptions and proposed solutions, make key risk-informed decisions, and preserve security-by-design principles throughout transaction planning and execution. • Proven ability to partner with ISRM policy, capability, architecture, risk, and control owners to reconcile enterprise security requirements with transaction constraints and keep integration and separation plans aligned with approved policies, standards, control objectives, and exception processes. • Experience influencing executives and driving cross-functional initiatives across highly matrixed, global environments. • Strong understanding of recognized cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO 27001, NIST 800-series publications, GDPR, HIPAA, and other applicable requirements. • Experience managing portfolios involving concurrent deals, assessments or workstreams, vendors, senior stakeholders, dependencies, and time-sensitive decisions. • Exceptional executive communication and presentation skills, with the ability to articulate technical risk, regulatory implications, business impact, residual exposure, and decision needs to non-technical audiences. • Demonstrated ability to navigate ambiguity, protect transaction confidentiality, drive organizational change, and improve repeatability through data, tools, automation, and disciplined governance. • Experience developing or operating A&D cybersecurity playbooks, questionnaires, control libraries, risk-scoring methods, RACI models, handoff criteria, and phase-based transaction standards. • Experience designing automation for intake, evidence collection, risk reporting, workflow orchestration, dashboards, and portfolio governance. • Experience partnering with Corporate Development, Legal, Privacy, Finance, Technology Services, business technology teams, IMO/SMO functions, external advisors, and managed service providers. • Experience in regulated healthcare, pharmaceutical, MedTech, manufacturing, or similarly complex global environments. Leadership Expectations • Operates as an enterprise-minded cybersecurity leader who balances transaction speed, regulatory and enterprise obligations, technical risk, stakeholder expectations, operational continuity, and value realization. • Maintains security by design through clear technical direction, informed challenge, disciplined governance, and partnership with enterprise policy and capability owners. • Builds repeatable systems rather than one-time solutions, emphasizing scalability, measurable outcomes, traceability, and continuous improvement. • Drives accountability by defining ownership, escalation paths, decision rights, quality standards, and delivery expectations. • Creates an inclusive, collaborative environment that encourages mentoring, knowledge sharing, pragmatic risk management, and high-quality execution. An internal pre-identified candidate for consideration has been identified. However, all applications will be considered. Remote work options may be considered on a case-by-case basis and if approved by the Company. Johnson & Johnson is committed to providing an interview process that is inclusive of our applicants’ needs. If you are an individual with a disability and would like to request an accommodation, please contact us via https://www.jnj.com/contact-us/careers or contact AskGS to be directed to your accommodation resource. Required Skills: Business Process Design, Creating Purpose, Crisis Management, Critical Thinking, Cybersecurity, Developing Others, Inclusive Leadership, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Leadership, Organizing, People Performance Management, Presentation Design, Process Optimization, Security Architecture Design, Security Policies The anticipated base pay range for this position is : $150,000.00 - $258,750.00 Additional Description for Pay Transparency: Subject to the terms of their respective plans, employees are eligible to participate in the Company’s consolidated retirement plan (pension) and savings plan (401(k)). This position is eligible to participate in the Company’s long-term incentive program. Subject to the terms of their respective policies and date of hire, employees are eligible for the following time off

Vacation –120 hours per calendar year Sick time - 40 hours per calendar year; for employees who reside in the State of Colorado –48 hours per calendar year; for employees who reside in the State of Washington –56 hours per calendar year Holiday pay, including Floating Holidays –13 days per calendar year Work, Personal and Family Time - up to 40 hours per calendar year Parental Leave – 480 hours within one year of the birth/adoption/foster care of a child Bereavement Leave – 240 hours for an immediate family member: 40 hours for an extended family member per calendar year Caregiver Leave – 80 hours in a 52-week rolling period10 days Volunteer Leave – 32 hours per calendar year Military Spouse Time-Off – 80 hours per calendar year Additional information can be found through the link below. The following link to general company benefits information MUST also be included in the posting: Please use the following language: For additional general information on Company benefits, please go to: - https://www.careers.jnj.com/employee-benefits