Senior Manager, Risk & Compliance Business Partners R&D

The Senior Manager, Risk & Compliance Business Partners R&D will lead a defined area of the Risk & Compliance Business Partners R&D capability and the team or programme that delivers it.

This is a delivery leadership role combining hands-on work with team and stakeholder management, providing hands-on risk and compliance consulting and assurance to R&D teams deploying and owning technology, based at the Ware, UK or London, UK Global Headquarters sites.

Key Responsibilities:

• Lead the R&D risk and compliance business partnering team at the Ware and London Global Headquarters sites, including its people, delivery and outcomes.
• Manage delivery against the R&D risk and compliance roadmap, escalating blockers to the Director, R&D Business Partners early.
• Develop team capability in R&D-specific risk and compliance consulting through coaching, review and structured feedback.
• Represent R&D risk and compliance interests in CSO governance forums and in R&D's own cross-functional governance structures, including Quality and GxP forums.
• Provide hands-on risk and compliance consulting and assurance to R&D teams deploying and owning technology, representing both risk and compliance perspectives.
• Own the cyber risk and compliance relationship for the assigned area, GSK Research and Development, including clinical, discovery and regulatory technology.
• Develop a working understanding of R&D business processes and priorities at the Ware and London Global Headquarters sites, and advise local R&D teams on how changing technology, threat and regulatory landscapes affect their risk posture.
• Support the Risk & Compliance governance forum (RMCB) for the assigned area, helping track priority actions, findings and CAPAs.
• Partner with Business Quality Assurance to support GxP validation of business-facing application systems and services within the assigned area.
• Support audit and inspection readiness activities, including evidence preparation and coordination for external inspections and regulator/auditor engagements.
• Support GxP software change management and system release governance for regulated applications within the assigned area.
• Identify, analyse and influence the management of cyber security risk across the assigned area, communicating risk clearly to manager and director-level audiences and balancing risk with operational considerations.
• Hold operational areas, risk owners and suppliers to account against the Cyber Security Office strategy for the assigned area.
• Build and maintain the cyber risk register for the area, including risk statements, ratings, owners and treatment plans.
• Embed security requirements and controls at the start of initiatives rather than retrofitting them before go-live, bringing in specialist consults on tooling and architecture design patterns from across the team as needed.
• Facilitate risk assessments for new initiatives, systems and third parties in the assigned area.

Basic Qualifications:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in cyber risk, technology risk or information security governance.
• Working knowledge of risk assessment and risk register management.
• Practical experience with senior business stakeholder engagement.
• Practical experience securing IT systems and applications in a regulated environment.
• Working familiarity with SOX and GxP compliance requirements.
• Working knowledge of SDLC best practices and software quality principles.
• Working knowledge of control frameworks, with the ability to advise on and assess control design.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality and timelines.
• Excellent relationship management, influencing and communication skills.

Preferred Qualifications:

• Experience acting as a business information security officer or embedded security partner.
• Working knowledge of NIST CSF, ISO 27001 and ISO 22301.
• Experience with GRC platforms such as ServiceNow.
• Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.
• Ability to influence senior stakeholders without direct authority.
• Relevant certification such as CISM, CRISC, CISA, CISSP.
• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Understanding of Operational Technology (OT) security concepts, ideally applied to a laboratory setting.
• Experience supporting audits and regulatory inspections.
• Broad understanding of, or readiness to develop understanding of, R&D business processes, operating environment and associated technology.