Associate Director, DDIT ISC Cyber Defense

Novartis AG; Sabadell; Hybrid; EUR 58,000 - 108,000; Full time

Job summary

Novartis AG in Barcelona, Spain, is seeking an experienced information security lead to drive country-specific cybersecurity compliance, advisory, and risk management initiatives. You will collaborate with SOC and cyber defense teams to improve detection capabilities and awareness programs.

With 8+ years in information security, you will translate regulatory requirements into practical controls, oversee audits, and guide stakeholders on secure practices while advancing AI-enabled security

Qualifications

• 8+ years of information security experience with governance, regulatory compliance, risk management or advisory.
• Experience implementing cybersecurity requirements in multinational environments, including NIS2 or similar.
• Familiarity with ISO 27001, NIST CSF and related controls.
• Ability to translate requirements into practical security measures for complex environments.
• Stakeholder management and ability to explain security to non-technical audiences.
• Hands-on with generative AI and AI coding assistants for rapid prototyping and automation.

Responsibilities

• Drive country-specific cybersecurity, privacy and AI regulations compliance.
• Advise business stakeholders on security policies, controls, and secure practices.
• Support audits, inspections, and certifications with evidence and remediation.
• Manage country-level security risks and incidents with SOC and cyber defense teams.
• Design security awareness programs including phishing simulations and campaigns.
• Leverage AI and low-code tools to streamline compliance and reporting.
• Collaborate across ISC, DDIT and business units for regulatory initiatives.
• Assess AI security risks including data exposure and prompt injection.

Skills

Information security governance

Cybersecurity regulatory compliance

Security risk management

Security advisory

AI and automation in security

Security awareness training

Incident response collaboration

Tools

Microsoft Defender XDR

Microsoft Sentinel

Kusto Query Language (KQL)

Job description

Salary Range:€57,900.00 - €107,500.00

Job Description Summary

Supports the delivery of the global ISC Country & Awareness program, with focus on country-specific information security requirements and initiatives, cybersecurity regulatory compliance, information security advisory, and security awareness. The role also drives the practical adoption of AI and automation across ISC activities, including AI-assisted development and vibe coding, while helping address security requirements and risks arising from the use of AI technologies. Partners with country and global stakeholders to address local security needs, translate regulatory and business requirements into practical security measures, strengthen security behaviors, and improve the effectiveness and efficiency of ISC activities. Works closely with Security Operations Center (SOC) and cyber defense teams to translate country, regulatory, threat, and incident insights into improved monitoring and new or enhanced detection rules.

Job Description

#LI-Hybrid

Location: Barcelona, Spain

Key Responsibilities:

• Drive implementation and ongoing compliance with country-specific cybersecurity, privacy, AI, and critical infrastructure regulations.
• Act as a trusted ISC advisor, guiding business and DDIT stakeholders on security policies, controls, and secure practices.
• Support cybersecurity audits, regulatory inspections, and certifications, including evidence preparation and remediation.
• Manage country-level security risks, issues, and incidents, collaborating with SOC, threat detection, incident response, and cyber defense teams.
• Design and deliver impactful security awareness and training programs, including phishing simulations, targeted training, and campaigns.
• Use security behavior data and insights to identify risks and develop targeted awareness interventions.
• Partner across ISC, DDIT, and business functions to coordinate regulatory, security, and country-specific initiatives.
• Leverage AI, automation, low-code/no-code, and AI-assisted development to streamline compliance, reporting, awareness, and security processes.
• Assess AI-related security risks, including data exposure, access controls, prompt injection, insecure integrations, third-party risks, and misuse.
• Monitor KPIs, emerging cyber threats, regulations, and technology trends, translating insights into improved controls, SOC detection capabilities, and security services.

Essential Requirement :

• 8+ years of experience in information security, with strong experience in security governance, cybersecurity regulatory compliance, security risk management, information security advisory, or related areas.
• Demonstrated experience implementing cybersecurity or technology regulatory requirements in a multinational environment, ideally including NIS2 or comparable national cybersecurity and critical infrastructure regulations.
• Strong knowledge of established information security frameworks and standards, such as ISO/IEC 27001, NIST Cybersecurity Framework and related security control frameworks.
• Experience translating information security and regulatory requirements into practical solutions within complex business and technology environments. Experience supporting security risk management, audits, regulatory assessments, inspections or compliance programs.
• Strong stakeholder management, communication and influencing skills, with the ability to explain complex cybersecurity topics to technical and non-technical audiences.
• Hands-on experience using generative AI and AI coding assistants for rapid prototyping or vibe coding, with the ability to build practical automations, integrations, workflows or lightweight applications. Experience may include tools such as GitHub Copilot, Microsoft Copilot, Power Platform, or comparable technologies.
• Good understanding of AI security risks and controls, including secure AI adoption, data protection, identity and access management, third-party or model risk, prompt injection, sensitive-data leakage, human oversight, monitoring and responsible use.
• Working knowledge of SOC operating processes, including security monitoring, alert triage, incident escalation, threat-informed detection engineering, detection-rule lifecycle management, testing and tuning. Ability to collaborate with SOC teams to establish new detection use cases and rules based on country, regulatory or threat requirements.

Desirable Requirement :

• Recognized information security certification such as CISSP, CISM, CRISC, CISA, CCSP, or ISO 27001 Lead Implementer/Lead Auditor. Experience designing or delivering security awareness and behavior-change programs, including phishing simulations, targeted awareness campaigns, or security training.
• Experience with security automation, SIEM or security analytics platforms, and development collaboration practices such as version control, testing and documentation. Experience with Microsoft Sentinel, Microsoft Defender XDR, Kusto Query Language (KQL), or comparable tech