Senior Manager, OT Cybersecurity

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at jnj.com .

As guided by Our Credo, Johnson & Johnson is responsible to our employees who work with us throughout the world. We provide an inclusive work environment where each person is considered as an individual. At Johnson & Johnson, we respect the diversity and dignity of our employees and recognize their merit.

Job Function:
Technology Product & Platform Management

Job Sub Function:
Multi-Family Technology Product & Platform Management

Job Category:
People Leader

All Job Posting Locations:
Belo Horizonte, Minas Gerais, Brazil, São Paulo, Brazil

Job Description:

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at https://www.jnj.com/ .

Johnson & Johnson announced plans to separate our Orthopedics business to establish a standalone orthopedics company, operating as DePuy Synthes. The process of the planned separation is anticipated to be completed within 18 to 24 months, subject to legal requirements, including consultation with works councils and other employee representative bodies, as may be required, regulatory approvals and other customary conditions and approvals. Should you accept this position, it is anticipated that, following conclusion of the transaction, you would be an employee of DePuy Synthes and your employment would be governed by DePuy Synthes employment processes, programs, policies, and benefit plans. In that case, details of any planned changes would be provided to you by DePuy Synthes at an appropriate time and subject to any necessary consultation processes.

DePuy Synthes is recruiting for a Senior Manager, OT Cyber located in Sao Paulo

The Senior Manager, OT Cyber is responsible for developing and executing the cybersecurity strategy, governance framework, and risk management capabilities necessary to protect critical manufacturing operations, industrial control systems, and operational technology environments across the Depuy Synthes OT ecosystem (Make, Deliver, R&D)

This role serves as a strategic partner within Cyber and has key stakeholders in Supply Chain, Manufacturing, IT and engagement with Cyber & Depuy Synthes IT & Business leadership to ensure OT cyber risks are identified, prioritized, and effectively managed while maintaining manufacturing availability, operational resilience, product quality, and regulatory compliance.

A critical near-term responsibility will be supporting the organization’s separation from J&J, ensuring OT cyber readiness for Day 1 operations, managing risks associated with shared infrastructure and Transitional Services Agreements (TSAs), and establishing an independent, sustainable OT cyber operating model.

The Senior Manager will balance immediate separation requirements with the development of a long-term OT cybersecurity program aligned with enterprise risk management objectives, manufacturing priorities, and recognized industry standards.

Key Responsibilities

1. OT Cyber Strategy & Governance

- Develop and execute a global OT cybersecurity strategy aligned with business objectives, manufacturing priorities, and enterprise cybersecurity requirements – leveraging existing OT strategic plans and maintaining continuity with existing stakeholders.
- Establish OT cyber governance, policies, standards, and accountability across manufacturing and supply chain operations.
- Define an OT cybersecurity operating model for future Depuy Synthes that clarifies responsibilities across Cyber, OT Engineering, IT, and third-party service providers.
- Develop a risk-based roadmap to improve OT security maturity and reduce exposure across OT environments.
- Establish measurable OT cybersecurity objectives, key risk indicators, and executive reporting capabilities.
- Align OT cybersecurity requirements with applicable regulatory expectations and industry frameworks, including NIST CSF, NIST SP 800-82, IEC 62443, and relevant medical device manufacturing quality requirements.

2. Business Separation, Day 1 Readiness & TSA Risk Management

- Lead OT cybersecurity readiness activities supporting the separation from J&J.
- Assess cyber risks associated with shared manufacturing / OT infrastructure, interconnected OT environments, inherited technologies, and parent company/J&J dependencies.
- Identify critical OT cybersecurity capabilities required for Day 1 operational readiness.
- Define and track OT cybersecurity risks, remediation activities, and compensating controls associated with TSA dependencies.
- Partner with separation teams to establish clear ownership of OT assets, security controls, monitoring capabilities, and incident response responsibilities.
- Support secure migration, segmentation, and separation of OT networks and systems from parent company environments.
- Establish OT cybersecurity requirements and security acceptance criteria for TSA exit.
- Ensure unresolved cybersecurity risks are documented, appropriately escalated, and formally accepted by accountable business leaders.

3. OT Cybersecurity Risk Management

- Establish a consistent methodology for identifying, assessing, prioritizing, and managing OT cybersecurity risks across global manufacturing sites.
- Partner with stakeholders across manufacturing, deliver & R&D to identify critical OT assets, industrial control systems, and production dependencies.
- Oversee OT cybersecurity risk assessments (CSRI) and establish remediation plans aligned with operational and business priorities.
- Evaluate risks associated with legacy manufacturing equipment, unsupported operating systems, industrial protocols, and third-party remote access.
- Develop risk treatment strategies that balance cybersecurity requirements with manufacturing availability, safety, product quality, and production continuity.
- Integrate OT cybersecurity risks into enterprise cyber risk reporting and governance processes.
- Provide executive leadership with clear visibility into critical manufacturing cybersecurity exposures and investment priorities.

4. OT Security Architecture & Control Oversight

- Partner with cybersecurity engineering and infrastructure teams to establish secure OT network architectures and appropriate segmentation between IT and OT environments.
- Oversee the adoption of risk-based OT cybersecurity controls, including asset visibility, vulnerability management, privileged access, remote connectivity, network monitoring, and secure configuration.
- Establish security expectations for OT technology suppliers, equipment manufacturers, system integrators, and external maintenance providers.
- Support the secure introduction of connected manufacturing technologies, industrial IoT, automation, and AI-enabled manufacturing capabilities.
- Ensure cybersecurity controls are implemented in a manner that minimizes disruption to critical manufacturing operations.

5. Manufacturing Cyber Resilience & Incident Readiness

- Establish OT cybersecurity incident response requirements and coordinate with enterprise security operations and manufacturing teams.
- Develop OT-specific incident response playbooks addressing ransomware, manufacturing system compromise, unauthorized remote access, and production disruptions.
- Partner with Manufacturing, R&D and Deliver teams re: Business Continuity and partner to define recovery priorities for critical production systems.
- Support OT cyber incident simulations and tabletop exercises with site leadership.
- Evaluate manufacturing recovery capabilities, backup dependencies, and operational resilience gaps.
- Establish escalation protocols for cybersecurity incidents that could impact product quality, manufacturing continuity, or patient safety.

6. Regulatory Compliance & Assurance

- Partner with Cyber GRC team to ensure OT cybersecurity practices support applicable regulatory and quality management requirements (i.e. NIS2).
- Ensure cybersecurity risk management activities appropriately consider GxP requirements, validated systems, and manufacturing change control processes where applicable.
- Establish ongoing reporting of OT cybersecurity compliance, control effectiveness, and remediation progress.

7. Stakeholder Engagement & Leadership

- Translate complex OT cybersecurity risks into business-relevant impacts, including production downtime, operational disruption, product quality, and financial exposure.
- Facilitate cross-functional decisions on OT cybersecurity investments, risk acceptance, and remediation priorities.
- Coordinate internal teams, external service providers, and system integrators responsible for OT cybersecurity initiatives.
- Influence site leadership to embed cybersecurity accountability into manufacturing operations and technology decisions.
- Develop executive-level OT cybersecurity reporting, highlighting material risks, program progress, and required business decisions.

Qualifications

- Bachelor’s degree in Cybersecurity, Information Technology, Engineering, Computer Science, or a related discipline.
- 8–12+ years of experience in IT, cybersecurity, IT/OT security, industrial technology, or manufacturing technology risk management.
- Demonstrated experience developing or managing OT cybersecurity programs in complex manufacturing environments.
- Strong understanding of industrial control systems, manufacturing technology, OT network architecture, and associated cybersecurity risks.
- Experience with cybersecurity risk assessments, security governance, vulnerability management, and risk remediation.
- Experience collaborating with manufacturing, engineering, infrastructure, and cybersecurity teams.
- Strong executive communication, stakeholder management, and program leadership capabilities.

.

At Johnson & Johnson, we believe health is everything. Our strength in healthcare innovation empowers us to build a world where complex diseases are prevented, treated, and cured, where treatments are smarter and less invasive, and solutions are personal. Through our expertise in Innovative Medicine and MedTech, we are uniquely positioned to innovate across the full spectrum of healthcare solutions today to deliver the breakthroughs of tomorrow, and profoundly impact health for humanity. Learn more at https://www.jnj.com/ .

Required Skills:

Preferred Skills:
Business Alignment, Business Architecture, Business Process Design, Business Savvy, Computer Programming, Cross-Functional Collaboration, Developing Others, Human-Computer Interaction (HCI), Inclusive Leadership, Leadership, Motivating People, Platform as a Service (PaaS), Product Knowledge, Software Development Management, Strategic Change, Tactical Planning, Team Management, Technical Credibility