Global Corporate Security Lead — Remote (Spain)

Jobgether; Madrid; Remote; EUR 90,000 - 130,000; Full time

Job summary

Roche is seeking an Expert in Information Security & Privacy Governance within ISPA to lead high-impact risk assessments and advocate for Security and Privacy-by-Design. You will bridge IT, business, and legal functions to implement controls for complex digital initiatives, including AI platforms, cloud security, and data platforms.

The role requires deep experience in governance, risk, and compliance across global environments, with hands-on advisory for cross-functional teams and enterprise

Qualifications

• 10+ years in IT security, GRC in global environments.
• Experience in Information Risk Assessments and DPIA.
• Knowledge of GDPR, CCPA/CPRA and cross-border data transfer regimes.
• Ability to translate legal requirements into technical controls.

Responsibilities

• Lead Security Expert Reviews for high-risk systems and privacy evaluations.
• Define risk controls with business and tech stakeholders; assign accountability.
• Advise on ISMS guidance and regulatory compliance; support cross-functional teams.

Skills

IT security

GRC

Privacy by design

Privacy frameworks

Education

Degree in Computer Science/Law/IT

Tools

ServiceNow IRM

ISMS

ISO 27001

Job description

Expert - Information Security & Privacy Governance

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.
The Position
As an Expert within Information Security & Privacy Advisory (ISPA), you move beyond "checking boxes" to become a high-impact partner for System Owners and global Engineering hubs.
The ISPA team serves as the strategic bridge between IT, business, and legal functions at Roche. You will lead critical security and privacy risk assessments to operationalize "Security and Privacy-by-Design" principles, ensuring complex digital initiatives, from AI platforms to enterprise systems, remain resilient, secure, and compliant.
Key Responsibilities
1. Expert Advisory & Risk Mitigation
+ High-Risk Reviews: Execute Security Expert Reviews (SER) for complex, high-risk system landscapes, performing deep-dive technical and privacy evaluations.
+ Risk Control & Mitigation: Negotiate risk-mitigating control objectives with business and technical stakeholders; ensure clear risk ownership and accountability.
+ Technical Baselines: Collaborate on Security Design Patterns and Technical Baselines for emerging technologies, including Generative AI, Cloud-native security, and advanced data platforms.
2. Strategic Liaison & Regulatory Governance
+ Data Privacy Partnership: Bridge IT, Legal, and Data Protection Officers (DPOs) to translate global legal requirements into technical and organizational controls.
+ ISMS Guidance: Advise business and IT owners on navigating Roche's Information Security Management System (ISMS) framework and external legal mandates.
+ Cross-Functional Support: Provide pragmatic guidance to strategic functions (e.g., R&D, Commercial, P&C) across global and local operational realities.
3. Agile Governance & Continuous Excellence
+ Workflow Management: Utilize Integrated Risk Management (IRM) platforms (e.g., ServiceNow) to manage advisory queues with audit-ready consistency.
+ Peer Assurance: Maintain high standards through a "Four-Eye" peer review culture and shared knowledge exchange across global team members.
+ Process Innovation: Lead initiatives to streamline risk assessment workflows, identifying opportunities for automation and AI efficiencies.
Qualifications
Experience
+ 10+ years in IT security, Governance, Risk, and Compliance (GRC) within complex, global environments.
+ Proven track record conducting Information Risk Assessments, Data Protection Impact Assessments (DPIA), and Cross-Border Data Transfer reviews.
+ Deep knowledge of international privacy frameworks (GDPR, CCPA/CPRA) and regulatory alignment (e.g., DoJ: 28 CFR Part 202).
+ Demonstrated experience providing pragmatic, business-aligned security advice on high-value, strategic projects across matrixed organizations.
Technical & Architectural Skills
+ Security Frameworks: Strong command of Information Security Management frameworks (e.g., ISO 27001, NIST).
+ Cloud & AI Security: Practical insight into cloud platforms (AWS, GCP, Azure), AI orchestration layers, and Security/Privacy-by-Design principles.
+ Technical Translation: Ability to translate complex legal and policy mandates into clear engineering requirements.
+ Workflow Tools: Experience with Integrated Risk Management (IRM) systems (e.g., ServiceNow IRM) for workload tracking is a plus.
Education & Certifications
+ Academic: Degree in Computer Science, Law, Information Technology, or equivalent practical experience.
+ Certifications: Highly valued: CISSP, CISM, CRISC, AIGP, or ISO 27001 Lead Auditor. Significant plus