Head of Secure SDLC & Enterprise Software Governance

(FCRS = US014) Novartis Pharmaceuticals Corporation; Barcelona; Hybrid; EUR 93,000 - 172,000; Full time

Benefits offered by this job

Insurance plans

Retirement plans

Flexible and hybrid working options

Parental leave

Job summary

Novartis Pharmaceuticals Corporation in Barcelona seeks a hands-on engineering leader who will own the enterprise SDLC governance model, build policy as code, and drive secure, audit-ready software delivery at scale.

You will influence hundreds of engineers through a federated community, work in repositories and pipelines, and shape controls for AI-assisted development while balancing regulatory requirements and business needs.

Qualifications

• You are a practitioner with substantial hands-on software engineering experience.
• 10+ years in software engineering or related fields including senior technical ownership of delivery pipelines at scale.
• Experience designing and operating automated controls in regulated environments with evidence of replacing manual compliance work with software.
• Fluency in regulated software requirements for pharma/life sciences: GxP, 21 CFR Part 11, GDPR considerations.
• Security engineering depth across application security and software supply chain security.
• Credible technical judgement on AI in the SDLC and governance implications.
• Ability to influence without authority across engineering, quality and business lines.
• Excellent written English.
• Desirable: pharma/biotech regulated industry exposure and familiarity with SOX ITGC and SaMD.
• Hands-on with modern stacks: Git-based platforms, policy/protection features, container orchestration, cloud, IaC, policy engines, test automation.

Responsibilities

• Own the enterprise policy, standards and controls for software engineering, including source control, branching, peer review, testing, release management, environment segregation, change control, configuration and release documentation.
• Rationalise overlapping GxP, SOX, privacy, security and IT-quality requirements into a single risk-based framework.
• Retire SDLC controls not reducing risk and enable tooling to securely speed up development at scale, leveraging AI tooling.
• Implement policy as code and controls as code, with branch protections, mandatory reviews, signed commits and immutable audit trails.
• Build automated, continuous evidence pipelines and define control telemetry including coverage, exceptions, drift, MTTR and effectiveness.
• Align with frameworks like NIST SSDF, ISO/IEC 27001 and IEC 62304 where applicable.
• Define controls for AI-assisted engineering including model lifecycle, provenance, attribution and human accountability for review/approval.
• Define controls for AI-containing products including documentation, drift monitoring and regulatory readiness.
• Use AI to reduce compliance burden through automated risk assessment drafting and control mapping.
• Lead a federated community of engineering, quality, security and compliance practitioners.

Skills

Hands-on software engineering

Stakeholder influence

Excellent written English

Ability to operate in a federated team

AI governance awareness

Tools

CI/CD pipelines

Policy as code

IaC

GxP/SOX knowledge

AI tooling in enterprise

Job description

Novartis Pharmaceuticals Corporation in Barcelona seeks a hands-on engineering leader who will own the enterprise SDLC governance model, build policy as code, and drive secure, audit-ready software delivery at scale.

You will influence hundreds of engineers through a federated community, work in repositories and pipelines, and shape controls for AI-assisted development while balancing regulatory requirements and business needs.