Senior Manager, Site Risk

GSK; Camden Town; On-site; GBP 90,000 - 130,000; Full time

Job summary

GSK seeks a Senior Manager, Site Risk to lead risk monitoring, indexing and automation across R&D labs and Supply Chain sites, blending hands-on delivery with team leadership.

You will own the Site Cyber Risk Index, develop KPIs, and coordinate with CSO governance, site leadership and OT engineering to improve risk posture.

This role requires a degree, extensive experience in cyber security and risk on industrial environments, and willingness to travel to sites.

Qualifications

• Degree in a relevant discipline or related experience.
• Experience in technology or OT risk in an operational site context.
• Working knowledge of site or plant risk assessment.
• Practical experience with stakeholder engagement with site and engineering leadership.
• Strong background in network security, OT security and operating in regulated environments.
• Experience building or operating continuous control monitoring, risk indices or KPI models.
• Experience partnering with penetration testing, red team or architecture review functions.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience delivering to plan, quality and timelines.

Responsibilities

• Lead a defined area of the capability, including its people, delivery and outcomes.
• Develop team capability through coaching, review and structured feedback.
• Represent the area in CSO governance and cross-functional forums.
• Build and maintain a deep understanding of the assets, threat intelligence, risks and controls across IT/OT.
• Build and run continuous control monitoring across sites to provide ongoing visibility into control effectiveness.
• Own and govern the Site Cyber Risk Index model and promote prioritized actions.
• Build out risk and performance indicators, and automation to drive remediation.
• Partner with site risk and compliance teams to engage site leadership effectively.
• Perform ad hoc risk assessments across sites as needed.
• Engage cyber defence and architecture teams to commission services like testing and reviews.
• Collaborate with OT engineering to understand operating environments.
• Coordinate with Risk Intelligence for data gathering and visualization.
• Track site remediation through to closure.

Skills

Technology risk

OT risk

Stakeholder engagement

Cyber security

Leadership

Risk indexing

Automation

Education

Degree in a relevant discipline

Tools

IEC 62443

NIST CSF

ISO 27001

Job description

Senior Manager, Site Risk

Business Introduction

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Job Purpose

The Senior Manager, Site Risk leads the site and OT risk monitoring, indexing and automation capability that supports GSK's business-facing Technology Risk and Compliance teams across R&D labs and Supply Chain sites, providing continuous visibility into the assets, threats, risks and control effectiveness operating in those environments. This is a delivery leadership role combining hands-on work with team and stakeholder management.

About the team. Site Risk provides the continuous monitoring, risk indexing and automation that GSK's business-facing Technology Risk and Compliance teams rely on to understand and manage cyber exposure at GSK's physical sites: the manufacturing plants, laboratories and R&D campuses where IT and operational technology meet. This position builds the risk intelligence, data and visibility that enables risk and compliance conversations with site leadership.

Key responsibilities:

• Lead a defined area of the capability, including its people, delivery and outcomes.
• Develop team capability through coaching, review and structured feedback.
• Represent the area in CSO governance and cross-functional forums.
• Build and maintain a deep understanding of the assets, threat intelligence, risks and controls operating across R&D labs and Supply Chain sites, spanning both IT and OT.
• Build and run continuous control monitoring across sites to provide ongoing visibility into control operating effectiveness across IT and OT, synthesizing asset understanding and threat intelligence to provide a holistic and continuous view of risk.
• Own and govern the Site Cyber Risk Index model, ensuring it accurately reflects site risk posture, is trusted by stakeholders and clearly recommends prioritized actions.
• Build out key risk and performance indicators, and automation, to help business-facing Technology Risk and Compliance teams drive and track action and remediation at their sites.
• Partner with the business partnering teams who own the site risk and compliance relationship, providing them with the data, indices and tooling they need to engage site leadership effectively.
• Perform ad hoc risk assessments across sites as needed.
• Engage cyber defence and cyber architecture and solutions teams to commission services such as penetration testing and detailed architectural reviews.
• Partner with OT engineering teams to understand the operating environment of the technology being assessed.
• Partner with the Risk Intelligence and Decision Support team on gathering and visualising site risk data.
• Track site remediation through to closure and escape where sites do not act.

Why you?

Basic Qualifications:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in technology or OT risk in an operational site context.
• Working knowledge of site or plant risk assessment.
• Practical experience with stakeholder engagement with site and engineering leadership.
• Strong background in network security, OT security and operating in regulated environments.
• Experience building or operating continuous control monitoring, risk indices or key risk/performance indicator models.
• Experience partnering with penetration testing, red team or architecture review functions to assess control effectiveness.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality and timelines.
• Excellent relationship management, influencing and communication skills.

Preferred Qualifications:

• Familiarity with IEC 62443 and OT security in manufacturing or laboratory settings.
• Working knowledge of NIST CSF and ISO 27001.
• Experience in pharmaceutical or another regulated manufacturing industry.
• Willingness to travel to sites as required.
• Relevant certification such as CRISC, CISM, CISSP, GICSP.
• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Experience partnering with data or ana