Associate Director IT Compliance

Novotech Global•South San Francisco, CA

4h•$160,000 - $180,000

About The Position

The Associate Director, IT Compliance is responsible for organising, leading and continuously improving Novotech’s IT Compliance function across a global CRO environment. The role provides leadership for IT governance, compliance assurance, audit readiness, vendor and sponsor audit responses, ISMS governance, ISO/IEC 27001:2022 certification activities, and regulatory compliance guidance for GxP computerised systems. This role acts as a key interface between IT, Information Security, Quality Assurance, Legal, Privacy, Business Operations, system owners, sponsors, vendors and external auditors. The successful candidate will ensure that Novotech’s IT practices, systems, documentation and control evidence remain inspection-ready and aligned with applicable regulatory, contractual, quality and information security requirements. The role requires a pragmatic compliance leader who can interpret regulatory obligations, translate them into practical IT controls and documentation, and guide business and technology teams through audit, certification, risk management and continuous improvement activities.

Requirements

Bachelor’s Degree in Information Technology, Computer Science, Information Security, Quality, Life Sciences, Regulatory Compliance, or a related discipline.
Significant experience in IT compliance, technology risk, governance, information security, quality systems or regulated technology environments.
Experience working in a regulated industry such as clinical research, pharmaceutical, biotechnology, medical device, healthcare or life sciences.
Demonstrated experience supporting vendor, sponsor, client, regulatory or certification audits.
Practical knowledge of ISO/IEC 27001, preferably ISO/IEC 27001:2022.
Experience maintaining ISMS records, control evidence, risk registers, audit records, policies, procedures or compliance documentation.
Understanding of GxP computerised system compliance and risk-based validation principles.
Familiarity with regulatory frameworks and expectations such as 21 CFR Part 11, EU Annex 11, GAMP 5, data integrity principles, GDPR or other privacy/security obligations.
Experience working with SaaS, cloud-hosted systems, vendor qualification, supplier audits or third-party risk assessments.
Experience engaging with cross-functional stakeholders across IT, QA, Legal, Privacy, Information Security and business operations.

Nice To Haves

ISO/IEC 27001 Lead Implementer, Lead Auditor, Internal Auditor or equivalent certification.
CISA, CRISC, CISM, CISSP, CGEIT or other relevant governance, risk, audit or information security certification.
GxP, CSV, CSA, GAMP 5 or life sciences validation training.
Privacy or data protection certification such as CIPP/E, CIPM or equivalent.
Experience in a Contract Research Organisation, clinical trial technology environment, pharmaceutical sponsor environment or regulated SaaS ecosystem.
Experience with ServiceNow, SharePoint, Smartsheet, Microsoft 365, GRC platforms, audit management tools or document management systems.
Experience with emerging AI technologies as related to the GxP system validation and functions.

Responsibilities

Lead, organise and manage the global IT Compliance function, ensuring clear priorities, operating cadence, responsibilities, documentation standards and service expectations.
Act as the primary IT Compliance lead for technology governance, IT control assurance, IT audit readiness and regulatory support.
Manage and coordinate IT responses to vendor, sponsor, client and regulatory audits involving IT systems, IT practices, information security controls and data privacy controls.
Manage and coordinate vendor, sponsor, client and regulatory reviews in relation to emerging AI and Machine Learning capabilities, as well as participate in strategy discussions related to AI.
Manage and maintain Information Security Management System records, registers, evidence repositories and governance documentation.
Support the ongoing operation, monitoring and continual improvement of Novotech’s ISMS.
Provide guidance to IT, Quality Assurance, system owners and business process owners on regulatory compliance expectations for GxP computerised systems.
Support interpretation and practical application of relevant regulatory and industry expectations, including GxP, computerised system validation, data integrity, 21 CFR Part 11, EU Annex 11 and GAMP 5-aligned risk-based validation principles.
Lead or support technology risk assessments for new and existing systems, vendors, services and IT processes.
Identify control gaps, compliance risks and documentation deficiencies, and work with accountable owners to define appropriate remediation or risk treatment plans.
Support supplier and vendor compliance assessments for technology vendors, cloud service providers, SaaS platforms and GxP-relevant suppliers.
Review supplier control evidence such as ISO certifications, SOC reports, validation documentation, security questionnaires, privacy documentation and contractual compliance requirements.
Own or contribute to IT Compliance policies, SOPs, work instructions, templates, guidance materials and evidence packs.
Translate complex regulatory, security and quality requirements into practical, business-friendly guidance.