Cybersecurity & Privacy Risk and Compliance Manager

1624 Roche Diagnostics S.L.; Sant Cugat del Vallès; On-site; EUR 90,000 - 130,000; Full time

Job summary

Roche is seeking a Cybersecurity & Privacy Risk Manager to lead a global risk management framework. You will translate risk data into strategic insights for executives, drive risk assessments, and ensure security-by-design across the enterprise in a SAFe environment.

The role requires 6+ years in cybersecurity/privacy risk management, strong governance skills, and deep regulatory knowledge (GDPR, HIPAA, ISO standards). Collaboration with Security, Legal, and Quality is essential.

Qualifications

• Bachelor’s degree in a relevant field; Master’s degree preferred.
• 6+ years in cybersecurity, privacy risk management, or information security governance in large multinational environments.
• Experience with SAFe and Agile frameworks; familiarity with GDPR and HIPAA; ISO 27001, NIST, CIS.

Responsibilities

• Drive risk assessments across global operations and product groups.
• Prepare executive risk reports and dashboards for decision-makers.
• Define and enforce risk tolerance aligned with business goals and regulatory mandates.
• Provide remediation guidance and drive process improvements with ROI on risk mitigation.
• Collaborate cross-functionally with Security, Privacy, Legal, Quality & Regulatory units.

Skills

Risk management

Governance

Stakeholder communication

SAFe / Agile

Education

Bachelor’s degree in Computer Science, Information Security, Business Information Systems

Master’s degree preferred

Job description

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.

Position Position Overview

The Cybersecurity & Privacy Risk Manager leads the development, execution, and continuous optimization of a robust, unified cybersecurity and privacy risk management framework across the enterprise. Operating globally within a Scaled Agile Framework (SAFe) environment, this role ensures that technology, digital healthcare solutions, and information assets remain secure, compliant, and resilient against evolving threats. By translating risk data into strategic actionable insights, the Risk Manager enables key decision-makers—from tactical Business Risk Owners to Senior Executive Leadership—to make informed, proactive decisions regarding risk tolerance, investment priorities, and governance.

Key Responsibilities

• Risk Assessment & Framework Execution: Drive comprehensive risk assessments across global business operations and product groups, identifying potential cybersecurity and privacy vulnerabilities, operational risks, and regulatory exposures.
• Executive & Governance Reporting: Formulate quantitative and qualitative risk reports and dashboards tailored for both operational Risk Owners and Senior Management decision-makers, establishing clear exposure visibility and strategic mitigation paths.
• Risk Tolerance & Strategy Alignment: Define, monitor, and enforce risk tolerance thresholds aligned with overall business goals and regulatory mandates (GDPR, HIPAA, ISO standards).
• Thought Leadership & Remediation Advisory: Provide expert consultative guidance on remediation strategies, risk treatment plans, and process improvements, demonstrating ROI on risk mitigation investments.
• Cross-Functional & Global Collaboration: Partner closely with global Security, Privacy, Legal, Quality & Regulatory, and Business units to embed security-by-design and privacy-by-design principles throughout the organizational lifecycle.

Requirements & Experience

• Education: Bachelor’s degree in Computer Science, Information Security, Business Information Systems, or a related field (Master’s degree preferred).
• Experience: 6+ years of experience in cybersecurity, privacy risk management, compliance, or information security governance within large-scale, multinational environments.
• Agile & Framework Expertise: Demonstrated experience operating within Scaled Agile (SAFe) and Agile frameworks, managing risks across matrixed development teams and governance levels.
• Compliance & Regulatory Knowledge: Deep familiarity with global privacy regulations (GDPR, HIPAA) and cybersecurity standards (ISO 27001, NIST, CIS).
• Stakeholder Communication: Proven ability to engage, challenge, and influence decision-makers at both operational risk-owner levels and Senior Management forums.
• Industry Background: Prior experience in healthcare, medical diagnostics, pharmaceuticals, or regulated digital software environments is strongly preferred.

Preferred Qualifications & Certifications

• Relevant industry certifications: CISA, CISM, CRISC, CISSP, ISO 27001 Lead Auditor, or equivalent.
• Strong data analytical capabilities with the ability to build risk models and present metric-driven strategies.
• Exemplary "Zoom Out / Zoom In" capability—able to define overarching global strategies while diving into granular technical risk scenarios when communicating with subject matter experts.

Who we are

A healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact. Let’s build a healthier future, together.

Roche is an Equal Opportunity Employer. We believe it’s urgent to deliver medical solutions right now – even as we develop innovations for the future. We are passionate about transforming patients’ lives. We are courageous in both decision and action. And we believe that good business means a better world. That is why we come to work each day. We commit ourselves to scientific rigor, unassailable ethics, and access to medical innovations for all. We do this today to build a better tomorrow. We are proud of who we are, what we do, and how we do it. We are many, working as one across functions, across companies, and across the world. We are Roche.