Associate Director, DDIT ISC Cyber Defense

ES06 (FCRS = ES006) Novartis Farmacéutica, S.A.; Sabadell; Hybrid; EUR 58,000 - 108,000; Full time

Job summary

Novartis Farmacéutica, S.A. in Barcelona, Spain, seeks an experienced information security professional to support the global ISC Country & Awareness program, focusing on regulatory compliance, awareness, and AI-enabled security initiatives.

The role collaborates with SOC and cyber defense teams to translate regulatory needs into practical controls and improved detection capabilities. The position requires 8+ years in information security, GCCP standards knowledge, and hands-on AI tooling

Qualifications

• 8+ years in information security and related areas.
• Experience implementing regulatory requirements in multinational environments.
• Knowledge of ISO/IEC 27001 and NIST CSF.

Responsibilities

• Drive compliance with country-specific cybersecurity and privacy regulations.
• Act as ISC advisor on security policies and controls.
• Support audits, inspections, and certifications.
• Design security awareness programs and phishing simulations.
• Collaborate with SOC and threat detection teams.

Skills

Information security

Regulatory compliance

Security governance

Stakeholder management

Communication

Cybersecurity

IT governance

Education

CISSP

CISM

CRISC

CISA

CCSP

ISO 27001 Lead Implementer

Tools

GitHub Copilot

Microsoft Copilot

Power Platform

Microsoft Sentinel

Microsoft Defender XDR

Kusto Query Language (KQL)

Job description

Salary Range: €57,900.00 - €107,500.00 Job Description Summary Supports the delivery of the global ISC Country & Awareness program, with focus on country-specific information security requirements and initiatives, cybersecurity regulatory compliance, information security advisory, and security awareness. The role also drives the practical adoption of AI and automation across ISC activities, including AI-assisted development and vibe coding, while helping address security requirements and risks arising from the use of AI technologies. Partners with country and global stakeholders to address local security needs, translate regulatory and business requirements into practical security measures, strengthen security behaviors, and improve the effectiveness and efficiency of ISC activities. Works closely with Security Operations Center (SOC) and cyber defense teams to translate country, regulatory, threat, and incident insights into improved monitoring and new or enhanced detection rules.

Job Description #LI-Hybrid Location: Barcelona, Spain

• Drive implementation and ongoing compliance with country-specific cybersecurity, privacy, AI, and critical infrastructure regulations.
• Act as a trusted ISC advisor, guiding business and DDIT stakeholders on security policies, controls, and secure practices.
• Support cybersecurity audits, regulatory inspections, and certifications, including evidence preparation and remediation.
• Manage country-level security risks, issues, and incidents, collaborating with SOC, threat detection, incident response, and cyber defense teams.
• Design and deliver impactful security awareness and training programs, including phishing simulations, targeted training, and campaigns.
• Use security behavior data and insights to identify risks and develop targeted awareness interventions.
• Partner across ISC, DDIT, and business functions to coordinate regulatory, security, and country-specific initiatives.
• Leverage AI, automation, low-code/no-code, and AI-assisted development to streamline compliance, reporting, awareness, and security processes.
• Assess AI-related security risks, including data exposure, access controls, prompt injection, insecure integrations, third-party risks, and misuse.
• Monitor KPIs, emerging cyber threats, regulations, and technology trends, translating insights into improved controls, SOC detection capabilities, and security services.

Essential Requirements

• 8+ years of experience in information security, with strong experience in security governance, cybersecurity regulatory compliance, security risk management, information security advisory, or related areas.
• Demonstrated experience implementing cybersecurity or technology regulatory requirements in a multinational environment, ideally including NIS2 or comparable national cybersecurity and critical infrastructure regulations.
• Strong knowledge of established information security frameworks and standards, such as ISO/IEC 27001, NIST Cybersecurity Framework and related security control frameworks.
• Experience translating information security and regulatory requirements into practical solutions within complex business and technology environments.
• Experience supporting security risk management, audits, regulatory assessments, inspections or compliance programs.
• Strong stakeholder management, communication and influencing skills, with the ability to explain complex cybersecurity topics to technical and non-technical audiences.
• Hands‑on experience using generative AI and AI coding assistants for rapid prototyping or vibe coding, with the ability to build practical automations, integrations, workflows or lightweight applications.
• Experience may include tools such as GitHub Copilot, Microsoft Copilot, Power Platform, or comparable technologies.
• Good understanding of AI security risks and controls, including secure AI adoption, data protection, identity and access management, third‑party or model risk, prompt injection, sensitive‑data leakage, human oversight, monitoring and responsible use.
• Working knowledge of SOC operating processes, including security monitoring, alert triage, incident escalation, threat‑informed detection engineering, detection‑rule lifecycle management, testing and tuning.
• Ability to collaborate with SOC teams to establish new detection use cases and rules based on country, regulatory or threat requirements.

Desirable Requirements

• Recognized information security certification such as CISSP, CISM, CRISC, CISA, CCSP, or ISO 27001 Lead Implementer/Lead Auditor.
• Experience designing or delivering security awareness and behavior‑change programs, including phishing simulations, targeted awareness campaigns, or security training.
• Experience with security automation, SIEM or security analytics platforms, and development collaboration practices such as version control, testing and documentation.
• Experience with Microsoft Sentinel, Microsoft Defender XDR, Kusto Query Language (KQL), or comparable technologies are advantageous.
• Experience working within a large, global, and highly regulated organization, preferably within the pharmaceutical, healthcare or life sciences industry.

Skills Desired

Business Acumen, Business Partnerships, Communication, Cybersecurity, Influencing Skills, Information Security Risk Management, IT Governance, Organizational Awareness, Stakeholder Management

Improving the lives of people living with disease takes more than innovative science. It takes a focus on the needs of people and a community committed to meeting them. It takes a team of people like you. Working together. Learning together. Thriving together. Discover how you can join us in changing people’s lives.

Benefits & Rewards

Benefits & Rewards At Novartis, we’re committed to reimagining medicine together - and rewarding the people who make it happen. Expected Annual Base Salary Range for role: 57,900.00 - 107,500.00 EUR. The base salary offered is determined based on gender-neutral objectives, such as relevant skills, competencies and experience in accordance with the Novartis pay setting policy and upon joining Novartis will be reviewed periodically. In addition to your base salary, you may be eligible for a performance-based bonus depending on certain performance parameters. The rewards of being part of our team go far beyond base pay and incentives. We also offer a variety of competitive benefits in kind to help you thrive personally and professionally, such as insurance plans, retirement plans, wellbeing resources and global recognition programs. In addition, we provide flexible and hybrid working options, where possible, and minimum 14 weeks paid parental leave. Pay equity is a fundamental principle of our employment policy and reflects our commitment to create a diverse, equitable and inclusive environment that treats all employees with dignity and respect, as outlined in our Code of Ethics. Read our brochure to learn more about our global total rewards offering: https://www.novartis.com/sites/novartis_com/files/novartis-life-handbook.pdf Note: Benefits and compensation may vary by country and are subject to local legal requirements, including provisions of collective bargaining agreements where applicable. A full overview of your compensation package, including any relevant collective bargaining agreement details applicable to your role based on your employment location and Novartis employer entity, will be communicated separately to you during the application process.

Commitment to Diversity and Inclusion / EEO

Novartis is committed to building an outstanding, inclusive work environment and diverse teams’ representative of the patients and communities we serve.

Commitment to Diversity and Inclusion

Novartis is committed to building an outstanding, inclusive work environment and diverse teams' representative of the patients and communities we serve.

You’ll receive

You can find everything you need to know about our benefits and rewards in the Novartis Life Handbook. https://www.novartis.com/careers/benefits-rewards

In the context of China Cross-Border Data Transfer (CBDT) policy, if you need to apply for a position in China, please go to the local Recruiting System TaleNov.