Senior Information Security & Privacy Advisory Expert

Roche; Madrid; On-site; EUR 110,000 - 150,000; Full time

Job summary

Roche is seeking an Expert within Information Security & Privacy Advisory (ISPA) to partner with System Owners and global hubs, advancing Security-by-Design across complex digital initiatives including AI platforms and enterprise systems.

You will lead strategic risk assessments, advise on ISMS and regulatory governance, and collaborate with IT, Legal, and DPOs to implement pragmatic, business-aligned security solutions worldwide.

Qualifications

• 10+ years in IT security, Governance, Risk, and Compliance (GRC) within complex, global environments.
• Proven experience in Information Risk Assessments, DPIA, and Cross-Border Data Transfer reviews.
• Deep knowledge of GDPR, CCPA/CPRA, and regulatory alignment (DoJ: 28 CFR Part 202).

Responsibilities

• Expert Advisory & Risk Mitigation across complex system landscapes.
• High-Risk Reviews: perform Security Expert Reviews (SER) for high-risk environments.
• Negotiate risk-mitigating controls with business and technical stakeholders with clear ownership.
• Develop Security Design Patterns and Technical Baselines for AI, Cloud-native security, and data platforms.
• Bridge IT, Legal, and Data Protection Officers to translate global legal requirements into controls.
• Advise on Roche's ISMS framework and external regulatory mandates.
• Provide cross-functional security guidance to global teams (R&D, Commercial, P&C).
• Utilize IRM platforms (e.g., ServiceNow) for workload tracking and audit-ready processes.
• Lead process improvements to streamline risk assessment workflows and explore AI-assisted automation.

Skills

Security governance

Risk assessment

Privacy-by-Design

GDPR

DPIA

ISO 27001

NIST

Education

Degree in Computer Science/IT or Law

CISSP

CISM

CRISC

Tools

ServiceNow

IRM systems

Cloud platforms (AWS, GCP, Azure)

Job description

Roche is seeking an Expert within Information Security & Privacy Advisory (ISPA) to partner with System Owners and global hubs, advancing Security-by-Design across complex digital initiatives including AI platforms and enterprise systems.

You will lead strategic risk assessments, advise on ISMS and regulatory governance, and collaborate with IT, Legal, and DPOs to implement pragmatic, business-aligned security solutions worldwide.