Senior Director, Technology Risk & Compliance Business Partners - GSC & OT

GSK • Philadelphia, PA

3d • $195,000 - $325,000

About The Position

The Senior Director, Technology Risk & Compliance Business Partners - GSC & OT sets direction for the Technology Risk & Compliance Business Partners capability across GSK and leads the organization delivering it. This senior leadership role is accountable for the capability across GSK and covers Global Supply Chain and Operational Technology, including manufacturing and laboratory systems.

Technology Risk and Compliance Business Partners serve as the Cyber Security Office’s representatives to GSK business and technology areas. Each partner owns the cyber risk and compliance relationship for an assigned area, translates central strategy into practical actions, and brings that area’s risk back into the Cyber Security Office.

The role sets the multi-year strategy and secures investment, leads the organization and its capability plan, and owns the budget, vendor portfolio, and headcount plan. It represents the capability to senior technology leadership, auditors, and regulators; oversees cyber risk and compliance across Global Supply Chain and Operational Technology; and guides leaders on how changing technology, threats, and regulations affect risk posture and priorities. The role also oversees risk governance, GxP validation and change management, audit and inspection readiness, and the responsible use of approved AI tools by the team.

Requirements

• Degree in a relevant discipline, or related experience.
• Experience in cyber risk, technology risk, or information security governance.
• Experience with risk assessment and risk register management.
• Experience engaging with senior business stakeholders.
• Experience in cyber security, including leading a global capability at scale.
• Experience leading leaders of teams across multiple geographies.
• Experience owning a capability budget and vendor portfolio.
• Experience influencing and communicating at executive and board level.
• Experience with service definition and process improvement methodologies.

Nice To Haves

• Experience acting as a business information security officer or embedded security partner.
• Working knowledge of NIST CSF, ISO 27001, and ISO 22301.
• Experience with GRC platforms such as ServiceNow.
• Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.
• Ability to influence senior stakeholders without direct authority.
• Relevant certification such as CISM, CRISC, CISA, or CISSP.
• Experience in pharmaceutical, life sciences, or another highly regulated industry.
• Understanding of Operational Technology security concepts applied across manufacturing, distribution, quality laboratory, and supply chain environments.

Responsibilities

• Set the multi-year strategy for the Technology Risk & Compliance Business Partners - GSC & OT capability and secure the investment needed to deliver it.
• Drive a risk-accountable leadership culture and a cyber- and risk-savvy workforce culture in Global Supply Chain and Operational Technology.
• Lead the Technology Risk & Compliance Business Partners - GSC & OT organization, including leaders of teams, and own its capability plan.
• Own the capability budget, vendor portfolio, and headcount plan.
• Represent the capability to the CISO, GSK Tech leadership, auditors, and regulators, including supporting risk and compliance for Sarbanes Oxley, privacy regulations, and Anti-Bribery and Corruption.
• Own the cyber risk and compliance relationship for Global Supply Chain and Operational Technology, including manufacturing and laboratory systems.
• Identify, analyse, and influence the management of cyber security risk across the assigned area.
• Hold operational areas, risk owners, and suppliers accountable against the Cyber Security Office strategy for the assigned area.
• Build and maintain the area’s cyber risk register, including risk statements, ratings, owners, and treatment plans.
• Develop a deep understanding of Global Supply Chain business processes and supporting IT and OT systems, including ERP and integrated ecosystems, Manufacturing Execution Systems, Warehouse Management Systems, SCADA, and industrial control systems.
• Guide Global Supply Chain leadership on how changes in technology, threats, and regulation affect risk posture, and influence priorities, investments, and roadmaps accordingly.
• Own the Risk & Compliance governance forum (RMCB) for the assigned area and ensure priority actions, findings, and CAPAs are tracked with clear accountabilities.
• Partner with Business Quality Assurance to ensure GxP validation of business-facing application systems and services in the assigned area.
• Provide oversight and coaching on audit and inspection readiness, including external inspections and regulator or auditor engagements, and reporting CAPA status.
• Provide oversight and coaching on GxP software change management and system release governance for regulated applications in the assigned area.
• Influence across the Cyber Security Office and broader Digital and Tech organization to identify and shape effective and efficient risk and compliance solutions.
• Lead the team in using approved AI tools to improve productivity and ways of working, model responsible use, and follow GSK Responsible AI, privacy, and security requirements.

Benefits

• Annual bonus.
• Eligibility to participate in a share-based long-term incentive program, dependent on role level.
• Health care and other insurance benefits for employees and family.
• Retirement benefits.
• Paid holidays.
• Vacation.
• Paid caregiver, parental, and medical leave.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior