Description
The Associate Director, Systems Risk leads the application and systems risk capability within GSK's Risk Operations Centre, reporting to the Director, Risk Detection & Response.
This role builds continuous control monitoring of applications and systems to assess control operating effectiveness and provide risk assurance, grounded in a deep understanding of the evolving threat landscape and the business context and architecture of GSK's critical systems.
Key Responsibilities:
- Build and maintain a deep understanding of the evolving threat landscape relevant to GSK's critical business applications and systems, as well as their business context and architecture.
- Build and run continuous control monitoring across applications and systems to provide ongoing visibility into control operating effectiveness, synthesising system understanding and threat intelligence into a holistic, continuous view of risk.
- Assess risk and provide assurance over application and system controls, informing risk treatment and prioritisation decisions.
- Lead ad hoc, detailed risk assessments of applications and systems, acting as subject matter expert on systems and application security and controls.
- Advise system and application owners on the controls their systems require and the risk they carry.
- Maintain the system risk register and keep it current as the estate changes.
- Partner closely with the Risk Intelligence and Automation team on gathering, automating and visualising application and systems risk data.
- Partner with the business-facing Technology Risk and Compliance Business Partners teams who own the business relationship, providing them with the data, risk assessments and assurance they need to engage system and business owners effectively.
- Influence the roadmap of teams building out the security capabilities needed to defend GSK's business systems and applications.
- Track system remediation and risk treatment through to closure.
- Feed systemic and cross-system risk themes back into policy, architecture and the wider Risk Operations Centre.
Basic Qualifications:
- Degree in a relevant discipline, or related experience.
- Demonstrated experience in technology or application risk assessment, control evaluation or information security risk.
- Strong understanding of the evolving threat landscape relevant to enterprise business systems and applications.
- Working knowledge of enterprise system and application architecture, with the ability to understand the business context of critical systems.
- Experience building or operating continuous control monitoring for applications or systems.
- Practical experience with risk register management.
- Significant experience in cyber security within the relevant domain.
- Proven experience leading a team or a substantial programme of work.
- Experience managing delivery to plan, quality and timelines.
- Excellent relationship management, influencing and communication skills, including the ability to influence the roadmap of other teams.
Preferred Qualifications:
- Working knowledge of NIST CSF, NIST 800-53 and ISO 27001.
- Experience assessing risk across the system lifecycle.
- Experience with GRC tooling such as ServiceNow.
- Experience in a regulated industry, including GxP systems.
- Experience partnering with data, analytics or automation teams to build continuous control monitoring, dashboards or risk indices.
- Familiarity with enterprise architecture frameworks or application security standards (e.g., OWASP, SANS Top 25).
- Relevant certification such as CRISC, CISA, CISM, CISSP.
- Experience in pharmaceutical, life sciences or another highly regulated industry.