Senior Director, Risk & Compliance Business Partners R&D

GSK • Philadelphia, PA

3d • $195,000 - $325,000

About The Position

The Senior Director, Risk & Compliance Business Partners R&D sets direction for the Risk & Compliance Business Partners R&D capability across GSK and leads the organization that delivers it. This senior leadership role is accountable for the capability across GSK and covers Research and Development, including clinical, discovery, and regulatory technology.

Technology Risk and Compliance Business Partners serve as the Cyber Security Office’s connection to GSK’s business and technology areas. Each partner owns the cyber risk and compliance relationship for an assigned area, translates central strategy into actions for that area, and brings its risks back to the Cyber Security Office.

The role sets multi-year strategy, develops the capability and its workforce, and manages its budget, vendors, and headcount. It owns the cyber risk and compliance relationship and governance for R&D, advises R&D leadership on risk implications of changes in technology, threats, and regulation, and provides oversight for risk management, audits and inspections, CAPAs, GxP validation, and software change and release governance. The role also leads responsible adoption of approved AI tools in accordance with GSK requirements.

Requirements

• Bachelor’s degree.
• Experience in cyber risk, technology risk, or information security governance.
• Experience conducting risk assessments and managing risk registers.
• Experience in cyber security, including leading a global capability.
• Experience leading people managers across multiple geographies.
• Experience managing a capability budget and vendor portfolio.
• Experience applying service definition and process improvement methodologies.
• Experience engaging senior business stakeholders.
• Influencing and communication skills at executive and board level.

Nice To Haves

• Experience acting as a business information security officer or embedded security partner.
• Working knowledge of NIST CSF, ISO 27001, and ISO 22301.
• Experience with GRC platforms such as ServiceNow.
• Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.
• Ability to influence senior stakeholders without direct authority.
• Relevant certification such as CISM, CRISC, CISA, or CISSP.
• Experience in pharmaceutical, life sciences, or another highly regulated industry.
• Understanding of Operational Technology (OT) security concepts, ideally applied to a laboratory setting.

Responsibilities

• Set the multi-year strategy for Risk & Compliance Business Partners R&D and secure the investment needed to deliver it.
• Drive a risk-accountable leadership culture and a cyber- and risk-savvy workforce culture in R&D.
• Lead the Risk & Compliance Business Partners R&D organization, including team leaders, and own its capability plan.
• Own the capability’s budget, vendor portfolio, and headcount plan.
• Represent the capability to the CISO, GSK Tech leadership, auditors, and regulators.
• Own the cyber risk and compliance relationship for GSK Research and Development, including clinical, discovery, and regulatory technology.
• Develop a deep understanding of R&D business processes and strategic priorities, and advise R&D leadership on how changing technology, threats, and regulation affect its risk posture.
• Influence across the Cyber Security Office and broader Digital and Tech organization to identify and shape effective and efficient risk and compliance solutions.
• Build and maintain the area’s cyber risk register, including risk statements, ratings, owners, and treatment plans.
• Own the RMCB risk and compliance governance forum for the assigned area, ensuring priority actions, findings, and CAPAs are tracked with clear accountabilities.
• Partner with Business Quality Assurance to ensure GxP validation of business-facing application systems and services in the assigned area.
• Provide team oversight and coaching on audit and inspection readiness, including hosting external inspections and regulator or auditor engagements, and reporting CAPA status.
• Provide team oversight and coaching on GxP software change management and system release governance for regulated applications in the assigned area.
• Lead the team in using approved AI tools to improve productivity and ways of working, role-modeling responsible use and following GSK’s Responsible AI, privacy, and security requirements.

Benefits

• Annual bonus.
• Eligibility to participate in a share-based long-term incentive program, dependent on role level.
• Health care and other insurance benefits for employees and their families.
• Retirement benefits.
• Paid holidays.
• Vacation.
• Paid caregiver, parental, and medical leave.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior