Mngr, Bus Info Security

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and Med Tech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity.

Learn more at  As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function:
Technology Enterprise Strategy & Security

Job Sub Function:
Security & Controls

Job Category:
Scientific/Technology

All Job Posting Locations:
Raritan, New Jersey, United States of America

Title:

Business Information Security Manager – ISRM Osprey Program Orthopedics Business Separation (New Co Formation)

Duration: 13 months (duration based role)

Employment Type:

Permanent (duration based, 13-month contract)

Remote or On-site:
Remote work or work in Raritan, NJ

Lead cybersecurity governance, risk management, and remediation support for the security aspects of the Osprey Program and the Orthopedics business separation. The Cybersecurity Manager will provide dedicated capacity to manage the expanding DMAB exception portfolio and enterprise data-segregation and least-privilege risks, while maintaining clear accountability with application owners and business leadership. The role will coordinate risk analysis, treatment planning, executive decisions, and sustained tracking so that separation milestones are achieved without weakening J&J base-business security outcomes.

• Accountable for supporting the cybersecurity management of Osprey-related governance and risk activities across affected applications.
• The role coordinates Business Information Security engagement for exception intake, IPT creation, risk analysis, S-RAAP development, mitigation planning, executive signoffs, and lifecycle tracking.
• Scope includes the current inventory of at least 156 Type 2 and 35 Type 3 DMAB exceptions, with responsibility to scale processes as demand grows; assess commingled-data and access risks; obtain validation from application owners on data segregation and least-privilege requirements; and support application owners in defining practical remediation approaches.
• The manager maintains governance discipline by ensuring operational remediation, evidence production, and exception accountability remain with the appropriate application owners and business leaders, while BIS provides security oversight, challenge, escalation, and advisory support.

• Establish a prioritized, risk-based operating cadence for Osprey exceptions, application reviews, remediation dependencies, approvals, and executive escalations.
• Direct consistent assessment of data commingling, access, segregation, monitoring, and residual-risk concerns across Osprey and retained J&J operations.
• Define clear RACI expectations, hold application and business owners accountable for execution, and elevate delayed actions or risk-acceptance decisions through the appropriate governance forums.

Provide expanded BIS capability support coverage for a limited-duration to fill a gap in capacity across ISRM teams for the Osprey program.

• DMAB exception portfolio:
  Accurate inventory, triage, prioritization, aging analysis, decision records, approvals, and closure…