Director, Culture & Cyber Risk & Behavioural Change

GSK; Irvine; Hybrid; GBP 120,000 - 160,000; Full time

Job summary

GSK is seeking a Director, Culture and Communities to lead the end‑to‑end capability, including strategy, delivery and performance across the security awareness and risk‑culture agenda. The role requires building and growing communities, partnering with senior stakeholders, and delivering measurable behavioural improvement at scale.

The position is hybrid in the United Kingdom, with leadership across global teams and collaboration with security champions, Secure Together, and external partners

Qualifications

• Degree in a relevant discipline, or related experience.
• Experience in security awareness, behavioural change or internal communications.
• Working knowledge of campaign design and measurement.
• Practical experience with stakeholder engagement across a global organisation.
• Working knowledge of human psychology, behavioural science or decision science, applied to influencing behaviour at scale.
• Proven experience building and growing communities, both inside and outside the organisation.
• Strong track record of using data and evidence, rather than effort or activity, to prove behavioural and cultural outcomes.
• Substantial experience in cyber security, including end-to-end ownership of a capability.
• Proven experience leading and developing technical or specialist teams.
• Experience managing budget, suppliers and delivery commitments.
• Strong influencing and communication skills with senior stakeholders.

Responsibilities

• Own the Culture and Communities capability end to end, including roadmap, delivery and service performance.
• Lead and develop the team, setting priorities and managing performance.
• Own the capability budget and supplier relationships.
• Report capability performance and risk to CSO leadership and governance forums.
• Own the cyber security awareness and behavioural change programme across GSK.
• Apply human psychology, behavioural and decision science to the design of culture and awareness interventions, moving beyond industry‑typical training and awareness approaches to build habits and defaults that measurably influence behaviours and reduce risk.
• Bring innovative and creative thinking to how GSK builds a risk‑aware culture, testing and scaling new approaches rather than repeating industry‑standard practice.
• Design and run campaigns which measurably influence the behaviours that drive GSK risk informed by current threat intelligence, evolving attacker tradecraft, and data including incidents, phishing simulations and other sources.
• Grow and run the Cyber Defenders security champions network across business units and sites, including sub‑networks of Code Defenders among developers and AI Igniters promoting safe and secure adoption of AI across the business.
• Grow and run the Secure Together community which encourages collaboration and sharing across Pharma and Life Sciences on shared security challenges, as well as sets expectations with suppliers and engages partners from Venture Capital and technology to influence roadmaps and investment priorities to align with GSK and industry security risk challenges.
• Own phishing simulation strategy, including scenario design, targeting and follow‑up learning.
• Measure behavioural outcomes rather than completion rates, and report on what is changing.

Skills

Cloud Security

Cybersecurity

Data Integrity

Executive Reports

Identity Access Management

Risk Assessments

Risk Management

Risk Management Framework

Security Architecture Design

Security Compliance

Security Policies

Security Risk

Third Party Risk Management

Vulnerability Management

Web Application Security

Job description

GSK is seeking a Director, Culture and Communities to lead the end‑to‑end capability, including strategy, delivery and performance across the security awareness and risk‑culture agenda. The role requires building and growing communities, partnering with senior stakeholders, and delivering measurable behavioural improvement at scale.

The position is hybrid in the United Kingdom, with leadership across global teams and collaboration with security champions, Secure Together, and external partners