Senior Director, Technology Risk & Compliance Business Partners - GSC & OT

GSK•Philadelphia, PA

About The Position

The Senior Director, Technology Risk & Compliance Business Partners - GSC & OT sets direction for the Technology Risk & Compliance Business Partners capability across GSK and leads the organisation delivering it. This senior leadership role is accountable for the capability across GSK, covering Global Supply Chain and Operational Technology, including manufacturing and laboratory systems. The Technology Risk and Compliance Business Partners serve as the Cyber Security Office’s connection to GSK business and technology areas. Each partner owns the cyber risk and compliance relationship for an assigned area, translating central strategy into practical actions and bringing that area’s risks back to the Cyber Security Office. The Senior Director owns the relationship for Global Supply Chain and Operational Technology and guides leaders on the effects of changing technology, threat and regulatory landscapes on their risk posture. The position leads the capability’s multi-year strategy, organisation, budget, vendor portfolio and headcount plan. It represents the capability to senior technology and security leadership, auditors and regulators; oversees risk governance, audit and inspection readiness, regulated application validation and release governance; and develops a risk-accountable, cyber-savvy culture. The role also leads responsible use of approved AI tools in accordance with GSK requirements. The US annual base salary for new hires ranges from $195,000 to $325,000. The position also offers an annual bonus and eligibility to participate in a share-based long-term incentive program, depending on role level. Available benefits include health care and other insurance for employees and families, retirement benefits, paid holidays, vacation, and paid caregiver/parental and medical leave.

Requirements

Degree in a relevant discipline, or related experience.
Experience in cyber risk, technology risk or information security governance.
Experience with risk assessment and risk register management.
Experience engaging with senior business stakeholders.
Experience in cyber security, including leading a global capability at scale.
Experience leading leaders of teams across multiple geographies.
Experience owning a capability budget and vendor portfolio.
Experience influencing and communicating at executive and board level.
Experience with service definition and process improvement methodologies.

Nice To Haves

Experience acting as a business information security officer or embedded security partner.
Working knowledge of NIST CSF, ISO 27001 and ISO 22301.
Experience with GRC platforms such as ServiceNow.
Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.
Ability to influence senior stakeholders without direct authority.
Relevant certification such as CISM, CRISC, CISA or CISSP.
Understanding of Operational Technology security concepts across manufacturing, distribution, quality laboratory and supply chain environments.

Responsibilities

Set the multi-year strategy for the Technology Risk & Compliance Business Partners - GSC & OT capability and secure the investment needed to deliver it.
Drive a risk-accountable leadership culture and a cyber- and risk-savvy workforce culture in Global Supply Chain and Operational Technology.
Lead the Technology Risk & Compliance Business Partners - GSC & OT organisation, including leaders of teams, and own its capability plan.
Own the capability budget, vendor portfolio and headcount plan.
Represent the capability to the CISO, GSK Tech leadership, auditors and regulators, including supporting risk and compliance for Sarbanes Oxley, privacy regulations and Anti-Bribery and Corruption.
Own the cyber risk and compliance relationship for Global Supply Chain and Operational Technology, including manufacturing and laboratory systems.
Identify, analyse and influence management of cyber security risk across the assigned area.
Hold operational areas, risk owners and suppliers accountable to the Cyber Security Office strategy for the assigned area.
Build and maintain the area's cyber risk register, including risk statements, ratings, owners and treatment plans.
Develop a deep understanding of Global Supply Chain processes and supporting IT and OT systems, including ERP ecosystems, Manufacturing Execution Systems, Warehouse Management Systems, SCADA and industrial control systems.
Guide Global Supply Chain leadership on how changing technology, threat and regulatory landscapes affect risk posture, and influence priorities, investments and roadmaps.
Own the Risk & Compliance governance forum (RMCB) for the assigned area, ensuring priority actions, findings and CAPAs are tracked with clear accountabilities.
Partner with Business Quality Assurance to ensure GxP validation of business-facing application systems and services within the assigned area.
Provide oversight and coaching on audit and inspection readiness, including hosting external inspections and regulator/auditor engagements, and reporting CAPA status.
Provide oversight and coaching on GxP software change management and system release governance for regulated applications within the assigned area.
Influence across the Cyber Security Office and broader Digital and Tech organisation to identify and shape effective, efficient risk and compliance management solutions.
Lead the team in using approved AI tools to improve productivity and ways of working, role-modeling responsible use and following GSK Responsible AI, privacy and security requirements.