# Director Technology Risk & Compliance Business Partners - R&D

**Company**: GSK
**Location**: London
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Healthcare

**Apply**: https://gsk.wd5.myworkdayjobs.com/en-US/GSKCareers/job/UK--London--New-Oxford-Street/Director-Technology-Risk---Compliance-Business-Partners---R-D_450070-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_9581c99b-97b

## Description

The Director Technology Risk & Compliance Business Partners – R&D is a leadership role accountable for being the primary point of contact for Technology Risk and Compliance across the R&D business unit, with a focus on the Cambridge, UK and Ware, UK sites.

Key responsibilities:

- Contribute to the multi-year strategy for Technology Risk & Compliance Business Partners – R&D, translating it into delivery plans for the Cambridge and Ware sites.

- Drive a risk-accountable leadership culture and a cyber- and risk-savvy workforce culture across the Cambridge and Ware sites.

- Lead and develop the team supporting the assigned area, setting priorities and managing performance.

- Report capability performance and risk to CSO leadership and governance forums.

- Own the cyber risk and compliance relationship for the assigned area, R&D with particular focus on the Cambridge and Ware sites, including clinical, discovery and regulatory technology.

- Develop a deep understanding of Research and Development business processes and strategic business priorities at the Cambridge and Ware sites, and guide local R&D leadership on how the changing technology, threat and regulatory landscapes affect their risk posture.

- Influence across the Cyber Security Office and broader Digital and Tech organisation to identify and shape solutions for effective and efficient risk and compliance management.

- Identify, analyse and influence the management of cyber security risk across the assigned area.

- Hold operational areas, risk owners and suppliers to account against the Cyber Security Office strategy for the assigned area.

- Build and maintain the cyber risk register for the area, including risk statements, ratings, owners and treatment plans.

- Facilitate Risk & Compliance governance (RMCB) activities for the assigned area, ensuring priority actions, findings and CAPAs are tracked with clear accountabilities.

- Partner with Business Quality Assurance to ensure GxP validation of business-facing application systems and services within the assigned area.

- Provide oversight and coaching to the team on audit and inspection readiness, including hosting of external inspections and regulator/auditor engagements, and on the reporting of CAPA status.

- Provide oversight and coaching to the team on GxP software change management and system release governance for regulated applications within the assigned area.

- Embed security requirements and controls at the start of initiatives rather than retrofitting them before go-live.

Basic Qualifications:

- Degree in a relevant discipline, or related experience.

- Demonstrated experience in cyber risk, technology risk or information security governance.

- Working knowledge of risk assessment and risk register management.

- Practical experience with senior business stakeholder engagement.

- Substantial experience in cyber security, including end-to-end ownership of a capability.

- Proven experience leading and developing technical or specialist teams.

- Experience managing suppliers and delivery commitments.

- Strong influencing and communication skills with senior stakeholders.

- Experience with service definition and process improvement methodologies.

Preferred Qualifications:

- Experience acting as a business information security officer or embedded security partner.

- Working knowledge of NIST CSF, ISO 27001 and ISO 22301.

- Experience with GRC platforms such as ServiceNow.

- Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.

- Ability to influence senior stakeholders without direct authority.

- Relevant certification such as CISM, CRISC, CISA, CISSP.

- Experience in pharmaceutical, life sciences or another highly regulated industry.

- Understanding of Operational Technology (OT) security concepts, ideally applied to a laboratory setting.

## Skills

### Required
- Cloud Security
- Cybersecurity
- Data Integrity
- Executive Reports
- Identity Access Management (IAM)
- Risk Assessments
- Risk Management
- Risk Management Framework
- Security Architecture Design
- Security Compliance
- Security Policies
- Security Risk
- Third Party Risk Management
- Vulnerability Management
- Web Application Security

### Nice to have
- NIST CSF
- ISO 27001
- ISO 22301
- GRC platforms such as ServiceNow
- CISM
- CRISC
- CISA
- CISSP

---

Source: [Apply at gsk.wd5.myworkdayjobs.com](https://gsk.wd5.myworkdayjobs.com/en-US/GSKCareers/job/UK--London--New-Oxford-Street/Director-Technology-Risk---Compliance-Business-Partners---R-D_450070-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)