SDLC Governance Lead — Secure, AI‑Driven Software

ES06 (FCRS = ES006) Novartis Farmacéutica, S.A.; Barcelona; Híbrido; EUR 93.000 - 172.000; Jornada completa

Descripción de la vacante

Novartis in Barcelona, Spain is seeking an experienced software governance leader to own the enterprise SDLC controls and policy framework. You will guide a federated community across engineering, quality, and security to accelerate compliant software delivery at scale.

You will define controls for AI-assisted engineering and AI-containing products, balancing speed with risk reduction, while collaborating with senior stakeholders and auditors.

Formación

• 10+ years in software engineering, platform engineering, DevSecOps or engineering quality, including senior technical ownership of delivery pipelines at scale.
• Hands-on software engineering experience: you have written production code, owned CI/CD pipelines, and can read/modify pipeline configuration, IaC and policy code today, unaided.
• Working fluency in regulated-software requirements relevant to pharma/life sciences: GxP, GAMP 5 (2nd Ed.), CSA, 21 CFR Part 11, EU Annex 11 and data integrity/ALCOA+.
• Security engineering depth: application security, software supply chain security, secrets and identity management, vulnerability management.
• Credible technical judgement on AI in the SDLC — governance implications.
• Ability to influence without authority across engineering, quality and business lines, and hold positions with senior stakeholders and auditors.
• Excellent written English.

Responsabilidades

• Own the enterprise policy, standards and controls for software engineering, including source control, branching, peer review, testing, release management, environment segregation, change control, configuration and release documentation.
• Rationalise overlapping GxP, SOX, privacy, security and IT-quality requirements into one coherent framework, ensuring low-risk tools are not over-governed.
• Retire SDLC controls that do not reduce risk and enable tooling to accelerate secure development at scale, leveraging AI tooling.
• Implement policy as code and controls as code, including branch protections, mandatory review, signed commits and immutable audit trails.
• Build automated, continuous evidence pipelines and define control telemetry (coverage, exceptions, drift, MTTR, effectiveness).
• Own secure-by-default guardrails in pipelines and platforms, aligning with NIST SSDF, ISO 27001 and IEC 62304 where applicable.
• Define controls for AI-assisted engineering, including licensing, provenance, and human oversight for review/approval.
• Define controls for AI-containing products, including model lifecycle, data docs, evaluation, drift, explainability and regulatory readiness.
• Use AI to reduce compliance burden via automated risk drafting, control mapping and test generation; act as technical authority for audits and SDLC remediation.
• Lead a federated community of engineering, quality, security and compliance practitioners and guide senior leaders on risk.

Conocimientos

Hands-on software Eng

CI/CD pipelines

Policy as code

GxP compliance

Security engineering

AI governance

Influence without authority

English proficiency

Herramientas

Container orchestration

Cloud

IaC

Policy engines (e.g. OPA/Rego)

Descripción del empleo

Novartis in Barcelona, Spain is seeking an experienced software governance leader to own the enterprise SDLC controls and policy framework. You will guide a federated community across engineering, quality, and security to accelerate compliant software delivery at scale.

You will define controls for AI-assisted engineering and AI-containing products, balancing speed with risk reduction, while collaborating with senior stakeholders and auditors.