Reporting to the Director of Supply Chain Resiliency and Customer Excellence, and dotted line to Sr. Manager of Third-party Risk and Enterprise Business Continuity, this position is responsible for the execution of supplier cybersecurity programs and projects to proactively manage risk throughout supplier lifecycle. Activities will include on-boarding due-diligence including cyber vetting during RFPs, contract language reviews, risk assessments, audit support, and remediation. They will also support supplier related cyber incident response and recovery activities. This role will also help to identify gaps and drive programs to achieve procurement and supplier conformity to ethics and compliance responsibilities, including legal, regulatory and privacy compliance.
Job Description
We are the makers of possible
BD is one of the largest global medical technology companies in the world. Advancing the world of health™ is our Purpose, and it's no small feat. It takes the imagination and passion of all of us-from design and engineering to the manufacturing and marketing of our billions of MedTech products per year-to look at the impossible and find transformative solutions that turn dreams into possibilities.
We believe that the human element, across our global teams, is what allows us to continually evolve. Join us and discover an environment in which you'll be supported to learn, grow and become your best self. Become a maker of possible with us.
This role will be responsible for ensuring supplier cybersecurity due-diligence requirements are appropriately being adopted and followed globally, while working across a highly-matrixed environment. In addition, this role will be responsible for ensuring the execution of cyber assurance controls for Global Procurement associates and suppliers. This role will help to ensure vendor compliance to cybersecurity & privacy policies, contractual information security & data privacy obligations, and applicable cybersecurity regulatory requirements, globally. This role will also inform the overall supplier cybersecurity strategy within the third party cybersecurity framework.
Within the Global Procurement Supply Chain Resiliency team, this person will collaborate across BD businesses, Global Procurement, Cybersecurity & Digital Risk, R&D stakeholders, Product Security and Integrated Supply Chain (ISC) to promote our security requirements, monitor and support governance activities and maintain compliance to cyber regulations that may impact our information security program. This individual will be responsible for metrics and KPIs consumed by both Global Procurement and the Cybersecurity & Digital Risk (C&DR) teams. They should be comfortable with data analysis and aggregation to drive informed decision making.
This individual is comfortable performing risk assessments to identify gaps in supplier conformance to BD policies, cybersecurity regulatory, and contractual obligations.
The role will be responsible for providing regular program updates to procurement leadership team as well as the Cybersecurity & Digital Risk (C&DR) team. In collaboration with the Associate Director, Supplier Risk, the role will collaborate extensively with the Procurement supplier facing organization to ensure supplier cybersecurity program is deployed and adopted globally.
The role will work with C&DR team to align on requirements for appropriate third-party risk technology providers to provide supplier cyber risk insights. This individual will also be responsible for integration of supplier cyber metrics into Global Procurement's supplier risk model and on-going maintenance of key performance indicators of supplier cyber risk. Jointly with the C&DR team, the role will be a great partner with the third party providers, as it relates to supplier cyber risk.
This role will also support training activities including educating procurement teams and suppliers as necessary. The role may also prepare and deliver any necessary internal and external communications relative to supplier cybersecurity risk initiatives.
The role will participate to ensure proper due-diligence and assessment is performed for new suppliers and any suppliers acquired during the M&A process.
Breakdown of responsibilities:
40%
Lead program execution for supplier cybersecurity risk management to include:
Supplier due-diligence throughout the procurement lifecycle, inclusive of risk triage, assessment, remediation and monitoring
Supplier outreach to ensure process adoption and remediation of identified risk
Collaborate with C&DR team to align with the overall third-party cyber risk strategy and established information security policies
Performing supplier risk assessments to align with due-diligence requirements, using questionnaires and/or third-party vulnerability management platforms
Development and maintenance of metrics and indicators
Creation, documentation and continuous improvement of third-party risk management processes and procedures to meet internal and external audit requirements
25%
Incident Response and Risk Remediation Support supplier cyber incident response teams with prompt and accurate business relationship and impact data. Serve as single point of contact into Global Procurement for escalation and incident response team requests
Partner with C&DR team and third-party advisors to track and ensure closure to open remediation activities.
Collect and share learnings and continuous improvement ideas resulting from incident and remediation activities
25%
Supplier Ethics and Compliance Management
Drive closure to identified ethics, privacy and cybersecurity regulatory compliance related risks
Maintain relationships with Ethics & Compliance, Legal and Privacy teams to remain aware of supplier compliance risks and implement new controls as required
Ensure required information security contractual terms and conditions are present in applicable contracts and partner with Legal to remain aligned to evolving requirements
Support internal and/or external audits, customer RFIs and certification re-assessments which include third-party risk
10%
Training and Communications to support and educate procurement teams and suppliers
Partner with C&DR team to develop and waterfall supplier cyber risk related communications to wider procurement organization, stakeholders or suppliers
Support team report outs and alignment- engaging with both Global Procurement Risk Leadership and C&DR Third-party Risk teams on progress and strategy discussions as necessary
May perform other duties as required
Minimum Requirement:
Deep knowledge of security strategies and practices within a manufacturing business and 3rd party Risk management providers
Knowledge of Cyber Security standards such as NIST CSF, IS027001, ISO270002, SOC, etc. Significant knowledge of security standards, hardware, software, and practices.
Knowledge of Procurement, category management, Supplier Management in either or both Manufacturing and Services environments
Knowledge of industry standard risk management and/or auditing techniques
Skills:
Capable of executing, maintaining and improving programs that support critical strategies.
Change Management/Adoption
Strong business analytics
Meticulous assessment skills when reviewing documents for accuracy and consistency.
Risk Management
Strong interpersonal skills with the ability to influence others in a positive and effective manner
Excellent communication skills; both oral and written
Team Leadership (cross functional)
Working and influencing within a highly matrixed organization
Ability to quickly gain business acumen
Project and/or program management
Working in diverse environments
Strategic Thinker
Education Requirements:
Bachelor's degree or certification in Information Security, Information Systems Management or equivalent technical field or relevant industry experience is required. Or, Supply Chain Management, Business Administration degree with 3 years' experience in IT/Information security domains.
Experience:
7+ years of business project/program management experience, ideally within a regulated manufacturing environment
3+ years of specific Information Security or Risk Management related work experience
Previous knowledge of risk programs, preferably in a manufacturing setting.
Strong team player able to work both collaboratively and independently
Ability to work with ambiguity, complexity and under pressure with tight timelines and moving targets
Proficiency in using standard software tools (MS Office, PowerBI, MS Project, MS SharePoint, etc.
For certain roles at BD, employment is contingent upon the Company's receipt of sufficient proof that you are fully vaccinated against COVID-19. In some locations, testing for COVID-19 may be available and/or required. Consistent with BD's Workplace Accommodations Policy, requests for accommodation will be considered pursuant to applicable law.
Why Join Us?
A career at BD means being part of a team that values your opinions and contributions and that encourages you to bring your authentic self to work. It's also a place where we help each other be great, we do what's right, we hold each other accountable, and learn and improve every day.
To find purpose in the possibilities, we need people who can see the bigger picture, who understand the human story that underpins everything we do. We welcome people with the imagination and drive to help us reinvent the future of health. At BD, you'll discover a culture in which you can learn, grow, and thrive. And find satisfaction in doing your part to make the world a better place.
To learn more about BD visit https://bd.com/careers
Becton, Dickinson and Company is an Equal Opportunity/Affirmative Action Employer. We do not unlawfully discriminate on the basis of race, color, religion, age, sex, creed, national origin, ancestry, citizenship status, marital or domestic or civil union status, familial status, affectional or sexual orientation, gender identity or expression, genetics, disability, military eligibility or veteran status, or any other protected status.
Primary Work Location
USA NJ - Franklin Lakes
Additional Locations
USA AZ - Tempe Headquarters, USA IL - Vernon Hills, USA MD - Sparks - 7 Loveton Circle, USA UT - Sandy
Work Shift
At BD, we are strongly committed to investing in our associates-their well-being and development, and in providing rewards and recognition opportunities that promote a performance-based culture. We demonstrate this commitment by offering a valuable, competitive package of compensation and benefits programs which you can learn more about on our Careers Site under Our Commitment to You .
Salary or hourly rate ranges have been implemented to reward associates fairly and competitively, as well as to support recognition of associates' progress, ranging from entry level to experts in their field, and talent mobility. There are many factors, such as location, that contribute to the range displayed. The salary or hourly rate offered to a successful candidate is based on experience, education, skills, and any step rate pay system of the actual work location, as applicable to the role or position. Salary or hourly pay ranges may vary for Field-based and Remote roles.
