A&D Post-Close Security Director

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function: Technology Enterprise Strategy & Security Job Sub Function: Security & Controls Job Category: People Leader All Job Posting Locations: Alabama (Any City), Alabama (Any City), Alaska (Any City), Arizona (Any City), Arkansas (Any City), California (Any City), Colorado (Any City), Connecticut (Any City), Delaware (Any City), Florida (Any City), Georgia (Any City), Hawaii (Any City), Idaho (Any City), Illinois (Any City), Indiana (Any City), Iowa (Any City), Kansas (Any City), Kentucky (Any City), Louisiana (Any City), Maine (Any City), Maryland (Any City), Massachusetts (Any City), Michigan (Any City), Minnesota (Any City), Mississippi (Any City) {+ 26 more}

Job Description

The Director, Information Security Risk Management (ISRM) Acquisitions & Divestitures (A&D) Cybersecurity, Post-Close, serves as the strategic leader responsible for defining, governing, and continuously improving the enterprise cybersecurity approach for post-close acquisitions, divestitures, licensing arrangements, separations, integrations, minority investments, and strategic partnerships. This role provides executive leadership and oversight for post-close mobilization, Day 1 stabilization, transition governance, risk remediation, integration and separation execution, TSA delivery and exit, and ongoing portfolio performance. The Director applies comprehensive regulatory and compliance insight together with broad technical expertise across cybersecurity and enterprise technology to troubleshoot complex delivery issues, challenge proposed solutions, make key risk-informed decisions, and preserve security-by-design principles throughout integration and separation. The Director partners closely with Corporate Development, Legal, Privacy, Finance, Technology Services, ISRM capability and policy owners, business technology leaders, IMO/SMO teams, transaction sponsors, and senior executives to ensure enterprise policy requirements are reflected in technical solutions, transition decisions, integration and separation plans, and approved exception handling.

Key Responsibilities

• Strategic Leadership, Policy Alignment & Governance: Define post-close cybersecurity strategy, governance, standards, operating rhythms, decision rights, and escalation paths. Partner with key ISRM policy, capability, architecture, risk, and control stakeholders to ensure enterprise requirements are embedded in integration and separation plans, technical designs, transition decisions, and approved exception processes.
• Post-Close Mobilization & Day 1 Stabilization: Convert deal scope, due diligence findings, Day 1 requirements, regulatory obligations, TSA assumptions, milestones, risks, and dependencies into prioritized execution plans with clear ownership and measurable outcomes.
• Integration, Separation & TSA Execution: Provide executive and technical oversight for identity, endpoints, infrastructure, cloud, applications, data protection, monitoring, incident response, third parties, regulatory obligations, and TSA delivery and exit.
• Technical Decision Leadership & Security by Design: Troubleshoot complex cybersecurity and technology issues, challenge proposed architectures and exceptions, make key risk-informed decisions, and ensure security-by-design requirements remain intact through transition, integration, separation, and decommissioning.
• Risk Remediation & Control Assurance: Ensure findings are prioritized, assigned, evidenced, escalated, and closed or formally accepted, with control validation and reporting that demonstrate progress and residual risk.
• Portfolio & Delivery Management: Oversee concurrent deals, workstreams, vendors, transition services, budgets, milestones, and dependencies, maintaining clear portfolio-level visibility.
• Automation & Process Transformation: Drive automation for intake, tracking, evidence, controls, notifications, dashboards, metrics, and reporting to improve traceability and scale delivery.
• Executive Engagement & Communication: Communicate progress, regulatory implications, risks, decisions, dependencies, business impacts, and resource needs to executives and governance forums.
• Operating Model & Continuous Improvement: Maintain playbooks, runbooks, templates, RACI models, capability standards, lessons learned, handoff criteria, and Definition of Done requirements.
• Organizational Leadership: Lead and develop managers, cybersecurity professionals, deal leads, project managers, and cross-functional contributors while promoting accountability, mentoring, knowledge sharing, and consistent delivery practices.

Qualifications

• Education: Bachelor's degree in Information Security, Computer Science, Engineering, Information Systems, Business, or a related discipline.
• Advanced degree (MBA, MS, or equivalent) preferred.

Required Experience & Skills

• 12+ years of progressive experience in cybersecurity, information risk management, technology leadership, M&A transaction support, integration or separation, or related disciplines.
• Demonstrated experience leading cybersecurity programs supporting acquisitions, divestitures, licensing, minority investments, strategic partnerships, or other complex business transactions.
• Comprehensive regulatory and compliance insight, including the ability to interpret applicable legal, privacy, industry, and enterprise obligations and translate them into practical transaction requirements, control decisions, and risk treatment.
• Broad technical expertise across security architecture, identity and access management, cloud and infrastructure security, endpoint security, network security, application security, data protection, vulnerability management, security operations, incident response, third parties, privacy, and cyber resilience.
• Demonstrated ability to troubleshoot complex cybersecurity and technology issues at a Director level, challenge technical assumptions and proposed solutions, make key risk-informed decisions, and preserve security-by-design principles throughout transaction planning and execution.
• Proven ability to partner with ISRM policy, capability, architecture, risk, and control owners to reconcile enterprise security requirements with transaction constraints and keep integration and separation plans aligned with approved policies, standards, control objectives, and exception processes.
• Experience influencing executives and driving cross-functional initiatives across highly matrixed, global environments.
• Strong understanding of recognized cybersecurity frameworks and standards, including NIST Cybersecurity Framework, ISO 27001, NIST 800-series publications, GDPR, HIPAA, and other applicable requirements.
• Experience managing portfolios involving concurrent deals, assessments or workstreams, vendors, senior stakeholders, dependencies, and time-sensitive decisions.
• Exceptional executive communication and presentation skills, with the ability to articulate technical risk, regulatory implications, business impact, residual exposure, and decision needs to non-technical audiences.
• Demonstrated ability to navigate ambiguity, protect transaction confidentiality, drive organizational change, and improve repeatability through data, tools, automation, and disciplined governance.

Preferred Experience

• Experience developing or operating A&D cybersecurity playbooks, questionnaires, control libraries, risk-scoring methods, RACI models, handoff criteria, and phase-based transaction standards