Principal – Third Party Cyber Risk Assessment
Not Disclosed•Full-TimeHybrid
location_onMichael's Inn, 46, Thompson Street, Raritan, Somerset County, New Jersey, 08869, United States
About Johnson & Johnson
At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity.
As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. We respect the diversity and dignity of our employees and recognize their merit. Caring for the world, one person at a time, has inspired and united our people for over 130 years. Today, as the world's largest and most broadly-based healthcare company, we are committed to using our reach and size for good, striving to improve access and affordability, create healthier communities, and put a healthy mind, body, and environment within reach of everyone, everywhere.
About the Role
This role serves as a senior technical authority and thought leader for third‑party cyber risk assessments across Johnson & Johnson's global ecosystem of vendors, SaaS providers, and strategic partners. As an integral member of the Information Security & Risk Management (ISRM) Risk Assessment Center of Excellence team, you will identify and assess cyber risks within the Third-Party Risk Assessment (TPRA) service.
You will work with a diverse, global team of skilled cyber security professionals to drive automation, process improvements, and consulting support. This position offers the opportunity to use your technical knowledge to change the trajectory of health for humanity by ensuring the security of our vast partner network.
Location & Availability
This role is based in the United States with the Raritan, NJ location preferred, but is also available internally to our ISRM Service Centers in São José dos Campos, São Paulo, Brasil, and Warsaw, Poland. Please note that this role is available across multiple countries and may be posted under different requisition numbers to comply with local requirements. While you are welcome to apply to any or all of the postings, we recommend focusing on the specific country(s) that align with your preferred location(s). Whether you apply to one or all of these requisition numbers, your applications will be considered as a single submission.
Hiring Process & Accommodations
Johnson & Johnson is committed to providing an interview process that is inclusive of our applicants' needs. If you are an individual with a disability and would like to request an accommodation, please contact us via jnj.com or contact AskGS to be directed to your accommodation resource.
Equal Opportunity & Culture
Johnson & Johnson is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, age, national origin, disability, protected veteran status, or other characteristics protected by federal, state, or local law. We actively seek qualified candidates who are protected veterans and individuals with disabilities as defined under VEVRAA and Section 503 of the Rehabilitation Act. We thrive on a diverse company culture, celebrating the uniqueness of our employees, and are committed to inclusion.
Work location
Work model: Hybrid
Michael's Inn, 46, Thompson Street, Raritan, Somerset County, New Jersey, 08869, United States
Raritan, New Jersey
Key Responsibilities
- check_circleLead third-party risk assessments, risk rankings, and remediation strategies
- check_circlePerform deep technical reviews of third-party security controls and evidence artifacts
- check_circleDrive automation and process improvements for third-party risk assessment
- check_circleCommunicate cybersecurity risk results to senior leaders and provide remediation input
- check_circleOffer consulting support to the cybersecurity team on risk assessment and remediation
- check_circleEvaluate complex risk scenarios involving sensitive data and cross-border flows
- check_circleDefine and implement process improvements to enhance third-party assessment workflows
- check_circleLead and mentor junior team members while supporting special projects
- check_circleIdentify, document, and risk-rate third-party cyber issues per ISRM standards
Requirements
- verifiedBachelor's degree in Computer Science, Engineering, Information Security/Cybersecurity or equivalent
- verified5+ years of direct third-party cybersecurity risk assessment experience
- verified5+ years using ServiceNow GRC tool
- verifiedCISSP, CCSP, CISA, CRISC certifications preferred
- verifiedAdvanced degree preferred
Nice to Have
Security certifications such as CISSP, CCSP, CISA, CRISC, etc. Advanced degree. Foundational knowledge of regulatory requirements (e.g., SOX404, Privacy, HIPAA, GxP, cyber regulations). Experience assessing third-party risk in a large, dynamic, multinational organization. Experience in identifying key security risks, security controls, and providing consulting services to customers throughout the third-party vendor lifecycle. Experience with security standards and control frameworks (e.g. FAIR, HITRUST, ISO27001, NIST, SOC 2, etc.). Demonstrable record of effectively collaborating with virtual, global teams, including diverse groups of people with varied backgrounds and cultural experiences. Business Process Design, Crisis Management, Critical Thinking, Information Security Auditing, Information Security Management System (ISMS), Information Technology (IT) Security Assessments, Information Technology Strategies, Mentorship, Organizing, Presentation Design, Process Optimization, Root Cause Analysis (RCA), Security Architecture Design, Security Policies, Technical Credibility, Vulnerability Management.
Benefits & Perks
check_circleMedical, dental, vision, life, short- and long-term disability, business accident, and group legal insurancecheck_circleConsolidated retirement plan (pension) and 401(k) savings plancheck_circleVacation time of 120 hours per calendar yearcheck_circleSick time of 40 hours per calendar year (56 hours for Washington state residents)Holiday pay including 13 floating holidays per calendar year
Similar Job Opportunities
Skills, education and keywords
Skills: Cissp, CCSP, Cisa, Crisc, Sox404, Hipaa, GXP, Fair, Hitrust, Iso27001.
Education: Bachelor's degree in Computer Science, Engineering, or Information Security/Cybersecurity required.
Frequently asked questions about Principal – Third Party Cyber Risk Assessment at Johnson & Johnson
What does a Principal – Third Party Cyber Risk Assessment at Johnson & Johnson do?expand_more
In this Principal – Third Party Cyber Risk Assessment at Johnson & Johnson role, you will lead third-party risk assessments, risk rankings, and remediation strategies; perform deep technical reviews of third-party security controls and evidence artifacts; drive automation and process improvements for third-party risk assessment; and communicate cybersecurity risk results to senior leaders and provide remediation input.
What are the requirements for this Principal – Third Party Cyber Risk Assessment role?expand_more
To qualify for the Principal – Third Party Cyber Risk Assessment at Johnson & Johnson position, applicants should have: Bachelor's degree in Computer Science, Engineering, Information Security/Cybersecurity or equivalent; 5+ years of direct third-party cybersecurity risk assessment experience; 5+ years using ServiceNow GRC tool; CISSP, CCSP, CISA, CRISC certifications preferred; and Advanced degree preferred.
Where is the Principal – Third Party Cyber Risk Assessment role at Johnson & Johnson located?expand_more
Principal – Third Party Cyber Risk Assessment at Johnson & Johnson is based in Michael's Inn, 46, Thompson Street, Raritan, Somerset County, New Jersey, 08869, United States. This is a hybrid role.
Is this Principal – Third Party Cyber Risk Assessment job remote, hybrid, or on-site?expand_more
Johnson & Johnson has listed this Principal – Third Party Cyber Risk Assessment role as hybrid.
How much experience is required for this Principal – Third Party Cyber Risk Assessment role?expand_more
Principal – Third Party Cyber Risk Assessment at Johnson & Johnson typically requires 5+ years of relevant experience at the senior level.
What skills do you need for the Principal – Third Party Cyber Risk Assessment role at Johnson & Johnson?expand_more
Key skills for Principal – Third Party Cyber Risk Assessment at Johnson & Johnson include Cissp; CCSP; Cisa; Crisc; Sox404; Hipaa; GXP; and Fair.
What education is required for Principal – Third Party Cyber Risk Assessment at Johnson & Johnson?expand_more
Educational requirements for this role: Bachelor's degree in Computer Science, Engineering, or Information Security/Cybersecurity required.
What category does the Principal – Third Party Cyber Risk Assessment role belong to?expand_more
Principal – Third Party Cyber Risk Assessment at Johnson & Johnson is part of the it job category on Recrutus.