Description
The Director Technology Risk & Compliance Business Partners – R&D is a leadership role accountable for being the primary point of contact for Technology Risk and Compliance across the R&D business unit, with a focus on the Cambridge, UK and Ware, UK sites.
Key responsibilities:
- Contribute to the multi-year strategy for Technology Risk & Compliance Business Partners – R&D, translating it into delivery plans for the Cambridge and Ware sites.
- Drive a risk-accountable leadership culture and a cyber- and risk-savvy workforce culture across the Cambridge and Ware sites.
- Lead and develop the team supporting the assigned area, setting priorities and managing performance.
- Report capability performance and risk to CSO leadership and governance forums.
- Own the cyber risk and compliance relationship for the assigned area, R&D with particular focus on the Cambridge and Ware sites, including clinical, discovery and regulatory technology.
- Develop a deep understanding of Research and Development business processes and strategic business priorities at the Cambridge and Ware sites, and guide local R&D leadership on how the changing technology, threat and regulatory landscapes affect their risk posture.
- Influence across the Cyber Security Office and broader Digital and Tech organisation to identify and shape solutions for effective and efficient risk and compliance management.
- Identify, analyse and influence the management of cyber security risk across the assigned area.
- Hold operational areas, risk owners and suppliers to account against the Cyber Security Office strategy for the assigned area.
- Build and maintain the cyber risk register for the area, including risk statements, ratings, owners and treatment plans.
- Facilitate Risk & Compliance governance (RMCB) activities for the assigned area, ensuring priority actions, findings and CAPAs are tracked with clear accountabilities.
- Partner with Business Quality Assurance to ensure GxP validation of business-facing application systems and services within the assigned area.
- Provide oversight and coaching to the team on audit and inspection readiness, including hosting of external inspections and regulator/auditor engagements, and on the reporting of CAPA status.
- Provide oversight and coaching to the team on GxP software change management and system release governance for regulated applications within the assigned area.
- Embed security requirements and controls at the start of initiatives rather than retrofitting them before go-live.
Basic Qualifications:
- Degree in a relevant discipline, or related experience.
- Demonstrated experience in cyber risk, technology risk or information security governance.
- Working knowledge of risk assessment and risk register management.
- Practical experience with senior business stakeholder engagement.
- Substantial experience in cyber security, including end-to-end ownership of a capability.
- Proven experience leading and developing technical or specialist teams.
- Experience managing suppliers and delivery commitments.
- Strong influencing and communication skills with senior stakeholders.
- Experience with service definition and process improvement methodologies.
Preferred Qualifications:
- Experience acting as a business information security officer or embedded security partner.
- Working knowledge of NIST CSF, ISO 27001 and ISO 22301.
- Experience with GRC platforms such as ServiceNow.
- Experience in pharmaceutical or another regulated industry, including GxP and SOX contexts.
- Ability to influence senior stakeholders without direct authority.
- Relevant certification such as CISM, CRISC, CISA, CISSP.
- Experience in pharmaceutical, life sciences or another highly regulated industry.
- Understanding of Operational Technology (OT) security concepts, ideally applied to a laboratory setting.