Cybersecurity Leader

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at https://www.jnj.com/. 

Johnson & Johnson is currently recruiting for a Cybersecurity leader supporting our Business Technology (all sectors) within the Information Security and Risk Management (ISRM) organization.

This position is to be located onsite in Russia at a J&J location (Moscow Krylatsky hills).

The Cybersecurity Leader will be the first point of contact for Russia (J&J’s operations in Russia) providing advice, security consultancy and cyber engineering for the (cross sector) Business Technology scope of work in Russia. This includes providing expert advice and guidance to ensure compliance with applicable cyber regulations. This critical role will partner closely with our local JJ Technology team to help ensure the secure design, configuration and operation of local systems and functions supporting and enabling our community of J&J employees, contractors and business partners.

Key responsibilities:

Strategic Management

Develop and submit cybersecurity strategy and annual development program to the General Director for approval. This includes the preparation of the Department budget and rationalise expenditure on safeguards, monitoring, audits, penetration testing, training, backup and response.

Develop and maintain the Company’s target information security model taking account of Russian law, the international group structure, the absence of production sites in Russia, global and local platforms, personal and medical data, supplier dependence, attached, remote and mobile work, and pharmacovigilance and clinical-research requirements.

Develop cyber risk map and regularly report material risks, residual risk and mitigation plans to management and set measurable objectives and indicators, including critical-vulnerability remediation times, training coverage, MFA coverage, response time and recovery time.

Participate in management, risk, audit, compliance, data-protection, business-continuity and other committees on information security matters.

Immediately inform the General Director of risks that may stop significant business processes, infringe data-subject rights, disclose commercial secrets, cause material financial or reputational harm, breach regulatory requirements, prevent pharmacovigilance obligations, or compromise global corporate systems.

Management of Policies and Regulatory Documents

Organize the development, review and implementation of policies governing information security, personal data, access management, information classification, remote work, mobile devices, vulnerability management, incident response, backup, secure development, suppliers, cloud services, commercial secrets, corporate email, messaging and file storage.

• Ensure that local documents comply, where applicable, with Federal Laws No. 149-FZ, 152-FZ, 98-FZ, 63-FZ and 187-FZ; Presidential Decree No. 250 of 1 May 2022; Government Resolutions No. 1272 of 15 July 2022 and No. 1119 of 1 November 2012; applicable orders of FSTEC, FSB and Roskomnadzor; Russian labor law; and licensing requirements.

• Regularly review local documents when legislation, Company structure, IT architecture or the nature of processed data changes

Business Information Security and local cyber engineering tasks include but not limited to:

• Provide Security consulting, assess risks and provide requirements for control design areas related to confidentiality, Integrity and Availability

• Raise visibility/reporting on risks and potential risks for security related issues/that cannot be resolved within the team

• Provide guidance on remediation and applying mitigating controls to known security gaps

• Review or approve cybersecurity results in SDLC as applicable

• Create/Adopt cybersecurity technical standards in support of the minimum cybersecurity requirements to drive standardization

• Increase Functionality and facilitate the utilization of Enterprise Tools (e.g., Asset Management, Iris, Yandex…) to Enable Business Outcomes

• Stay abreast of the latest trends in AI, machine learning, and automation in cybersecurity. Promote a culture of innovation by training team members on AI security tools and methodologies.
  
  Qualifications:

• A Bachelor’s or Master’s degree in Information Security, Information Protection, or a related field

• Alternatively, a degree in another discipline supplemented by professional experience in Information Security

• Ongoing professional development (advanced training) and certification in Information Security as required under the legislation of the Russian Federation

• At least 8 years of experience in technology or cybersecurity

• 5+ years of hands-on experience in delivering technology; and cybersecurity design and capabilities required

• Strategic approach to develop capability roadmaps that will enable proactive reliability through data & automation

• Solid grasp of current security threats, mitigation measures and security vendors/technologies.

• Experience working in fast-paced environments

• Experience with agile framework and process

• Creative problem-solving skills and understanding of complex environments (data, application, middleware, network)

• Previous experience developing effective and strong partnerships

• Superb communication in Russian, business English language and collaboration skills, ability to network and influence all levels - connecting with technical and non-technical audiences.

• Experience working as part of a high-performing multi-region team

• Ability to independently complete tasks accurately and thoroughly is required

• Regulatory knowledge (187, 152, 149, 1667 and other cybersecurity, technology and data compliance legislation in Russia and international)

• Security certifications: local FSTEC license for the Technical Protection of confidential information (TPCI) and international (CISSP, CISM, CRISC, ISO/IEC 27001)

• Experience in managing cybersecurity in life sciences environments