Senior Director, Technology Risk & Compliance Business Partners - Enterprise Systems

GSK•Upper Providence, PA

3d•Hybrid

About The Position

The Senior Director, Technology Risk & Compliance Business Partners - Enterprise Systems will set the direction for this capability across GSK and lead the organisation responsible for delivering it. This senior leadership role is accountable for the capability across GSK and covers enterprise systems, including finance, HR and core corporate platforms. Technology Risk and Compliance Business Partners represent the Cyber Security Office to GSK business and technology areas. Each partner owns the cyber risk and compliance relationship for an assigned area, translating central strategy into actions for that area and bringing its risks back to the Cyber Security Office. The role owns the relationship for Enterprise Systems, guides its leadership on risk and changing technology, threats and regulations, and oversees governance, audit readiness, GxP validation and regulated-system change management. The position is based in the United Kingdom and follows a hybrid working model, with two or three days per week onsite at GSK's central London headquarters.

Requirements

Degree in a relevant discipline, or related experience.
Demonstrated experience in cyber risk, technology risk or information security governance.
Working knowledge of risk assessment and risk register management.
Practical experience engaging senior business stakeholders.
Extensive experience in cyber security, including leading a global capability at scale.
Proven experience leading leaders of teams across multiple geographies.
Demonstrated ownership of a capability budget and vendor portfolio.
Excellent influencing and communication skills at executive and board level.
Experience with service definition and process improvement methodologies.

Nice To Haves

Experience acting as a business information security officer or embedded security partner.
Working knowledge of NIST CSF, ISO 27001 and ISO 22301.
Experience with GRC platforms such as ServiceNow.
Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.
Ability to influence senior stakeholders without direct authority.
Relevant certification such as CISM, CRISC, CISA or CISSP.
Experience in pharmaceutical, life sciences or another highly regulated industry.
Solid understanding of SOX (Sarbanes-Oxley) compliance requirements and internal controls over financial reporting.

Responsibilities

Set the multi-year strategy for the Technology Risk & Compliance Business Partners - Enterprise Systems capability and secure the investment needed to deliver it.
Drive a risk-accountable leadership culture and a cyber- and risk-savvy workforce culture in Enterprise Systems.
Lead the Technology Risk & Compliance Business Partners - Enterprise Systems organisation, including leaders of teams, and own its capability plan.
Own the capability's budget, vendor portfolio and headcount plan.
Represent the capability to the CISO, GSK Tech leadership, auditors and regulators.
Own the cyber risk and compliance relationship for Enterprise Systems, including finance, HR and core corporate platforms.
Identify, analyse and influence the management of cyber security risk across the assigned area.
Hold operational areas, risk owners and suppliers accountable to the Cyber Security Office strategy for the assigned area.
Build and maintain the area's cyber risk register, including risk statements, ratings, owners and treatment plans.
Develop a deep understanding of Enterprise Systems business processes, including Planning, Finance, HR, Procurement, Legal, Facilities and Real Estate, and technologies including ERP systems, particularly SAP, and SaaS technologies including Workday and Salesforce; guide Enterprise Systems leadership on how changes in technology, threats and regulations affect its risk posture.
Own the Risk & Compliance governance forum (RMCB) for the assigned area and ensure priority actions, findings and CAPAs are tracked with clear accountabilities.
Partner with Business Quality Assurance to ensure GxP validation of business-facing application systems and services in the assigned area.
Provide oversight and coaching to the team on audit and inspection readiness, including hosting external inspections and regulator or auditor engagements, and on reporting CAPA status.
Provide oversight and coaching to the team on GxP software change management and system release governance for regulated applications in the assigned area.
Influence across the Cyber Security Office and broader Digital and Tech organisation to identify and shape effective and efficient risk and compliance management solutions.