Q&A with a digital forensics and cybersecurity expert at J&J

What's a day in the life of a cybersecurity leader at the world’s largest and most diversified healthcare products company? Here's an inside look with Brent McCarty, Director of Cybersecurity Investigations at J&J, together with insights to help you join him. 

Brent's background: From digital forensics to cybersecurity and health innovation

Breakthroughs at the intersection of biology and technology can bring better health to people everywhere, from surgical procedures that can be personalized to the anatomy of each patient to VR training tools that could make higher-quality care more accessible for all.

But there are risks as well as opportunities. “The innovations we’re pursuing at J&J are absolutely astounding," Brent observes. "But they’re also highly sought after by our competition, nation-state interests and other threat actors.”

Addressing these and other challenges is the mandate for skilled technology professionals across multiple cybersecurity functions at J&J. For Brent, it entails analyzing anomalous data activity to ensure that high-value digital assets—intellectual property, trade secrets, regulatory submissions, drug formulas, clinical trial results, manufacturing protocols and more—are safe, protected and securely handled.

This is the kind of detective work that Brent, an expert in forensically driven digital investigations, does best. In his view, "Each case tells a story"—perhaps not unlike a Sherlock Holmes mystery. And like the famous literary sleuth, Brent is adept at seeing clues where others might not.  

“I’m asking the critically important ‘what if’ questions at all times, allowing the gathered evidence to drive a conclusion, then determining whether that conclusion poses a risk to J&J," he explains. 

Those contributions mainly take place behind the scenes, but Brent says he keeps our mission at J&J front and center—because for him, that mission is deeply personal.

“I have heart disease, and J&J is a leader in cardiovascular innovation," he says. "So, in a way, I feel like I’m working for this company that’s also working for me, which is really powerful."

Powerful, too, are the insights that Brent can share with you from a 20-plus-year career that has been anything but conventional. Find out more in the following Q&A, and explore jobs at J&J when you’re ready to join him.

Q: What’s your educational background?

A: I went to a local college after finishing high school, but I left after a year to pursue my dad’s commercial laundry business, which taught me a lot but I eventually realized wasn’t my cup of tea. By that time—this was 1998 or 1999—the MCSE certification from Microsoft was getting really big, so I decided to pursue it, leading to my first job in tech.

A few years later, I went back and earned my bachelor’s degree. But as far as other certifications go, so much of my career growth has been driven by on-the-job learning and experience, I haven’t really had time for a lot of them.

Q: What has allowed you to learn so much through on-the-job experience?

A: Asking a lot of questions. Who owns that? What does this or that partner do—that, and what else? In a large and complex environment like J&J, you have to peel back the layers and peer below the surface to understand what’s really going on. For example, it’s not uncommon in cybersecurity investigations for something to look extremely suspicious at first—you’re like, “Oh my goodness, what is going on here?”—but then you zoom in and realize it’s not suspicious at all, maybe just a gap in a system or process. Of course, the opposite might also turn out to be true. But it’s going to take a lot of questions before you’re able to understand and spot the difference.

Q: What else do you think might help people be successful in the field of cybersecurity investigations?

A: On some level, I think not being easily satisfied could be a useful personality trait for anyone involved in cybersecurity investigations. For example, if something doesn’t smell right, doesn’t feel right, doesn’t make sense, but you’re getting an answer that kind of makes sense, then it’s time to dig in and investigate, not to sit back and say, “Okay, I’m satisfied.” And I think that’s one thing that allows me to do my job effectively.

Another is that I take a rigorous, methodical, system- and process-oriented approach to pretty much everything I do, which is something I learned from my dad. As a businessman, he was all about repeatable processes, and I’m the same way. Solid systems and processes are key. They help you achieve your day-to-day objectives. They support ethical decision-making. And they help ensure that what you’re doing is legally defensible, which is understandably an important concern in security investigations.

Nothing is ever going to be perfect, of course, but having the right systems and processes in place makes it much less likely that you’ll go astray.

Q: Turning to your role with J&J, how would you describe what you do to someone outside of your field?

A: I’m a digital investigator. My team is tasked with collecting and analyzing digital information, empowering internal stakeholders and helping them protect business assets while addressing areas of concern, such as potential data loss.

Q: How would you describe your role to someone inside your field?

A: I’m leading the team to design, build and deploy consistent, compliant and legally defensible forensic-investigative processes. The goal is to support our security objectives at J&J while enabling us to more proactively identify and mitigate insider risks and threats to high-value digital assets. Right now, the focus is on building these processes into our case-management system, which should facilitate faster response times and allow us to resolve these concerns in a more tightly integrated and organized way.

Q: What would success look like, say, 6-12 months from now?

A: I’d like the program I just mentioned to be firmly established within the organization by then—for it to be known and socialized among all of our stakeholders, and for us to have a truly global presence. I’m really excited to see the impact and success of everything we’re working on.

Q: What are some of the biggest challenges you face in your job at J&J?

A: The types of health breakthroughs and innovations we’re working on at J&J are absolutely astounding. By the same token, they’re also highly sought after by competitors, nation-state interests and other threat actors. There could be cascading negative impacts if my team were to miss something, not only for the business but even potentially for patients downstream—it could delay the delivery of a critical product, for example. Challenges and concerns like that are always top of mind.

Q: What’s unique about working at J&J?

A: I think anyone remotely interested in technology will agree that this is a unique and special moment, with AI and all these new technologies coming along, yet we’re still just scratching the surface. What’s unique about working with these capabilities at a company like J&J goes back to Our Credo—knowing that your efforts will have a meaningful real-world impact. You’re positively impacting people’s lives every day. 

Q: If you hadn’t pursued a career in technology, what would you be doing right now?

A: I would be a musician. I play guitar and dabble in drums. Have you ever noticed how many people in tech either make music or have musical backgrounds? A lot of people. Kind of a surprising ratio, in my opinion. 

Anyway, I make music because I have a creative nature, and I love that I get to apply it at J&J. The program I’m building right now is a really good example of that. 

More broadly, I think joining J&J has been a creative endeavor in many respects. The whole experience—coming here, learning a new environment, building around it—all of that has been a really cool creative outlet for me.