Associate Director - Design Assurance & Product Management - Independent Design Assurance

14260 GSK India Global Services Private Limited; Bengaluru; On-site; INR 3,500,000 - 6,500,000; Full time

Job summary

GlaxoSmithKline plc in Bengaluru seeks a senior cyber security leader to head the eight-person Design Assurance practice within Cyber Architecture and Solutions. You own the assurance methodology, review standards and assurance register, and manage reviewer capacity against demand, ensuring pre-production architecture reviews and BAU assurance across the estate.

You will defend findings under audit, coordinate with cryptography and AI security domains, and drive automation and responsible AI

Qualifications

• 15+ years in cyber security, including leading technical or specialist teams.
• Ability to lead an independent design assurance practice and set methodology.
• Proven ability to defend assurance opinions under audit and interact with regulators.

Responsibilities

• Lead the Design Assurance practice of eight and own its capability plan across every Cyber Architecture and Solutions domain.
• Issue binding go/no-go determinations on tools pre-production and in BAU.
• Approve the assurance methodology, review standards and classification scheme, and defend them under audit.
• Verify against architecture standards set elsewhere and maintain independence from the standards you do not own.
• Manage reviewer capacity and tiering to ensure appropriate review for high-risk designs.
• Own pre-production architecture review and BAU design assurance across the estate.
• Drive AI tool usage to improve productivity while following Responsible AI guidelines.

Skills

Independent Design Assurance

Cyber security

Leadership

Education

Bachelor's degree

Tools

Power BI

ServiceNow

SABSA

TOGAF

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: Independent Design Assurance across all Cyber Architecture and Solutions security domains, including Cryptography and AI Security.

Job Purpose: Lead the Design Assurance practice, an eight-role team, as the most senior independent reviewer in Cyber Architecture and Solutions. You own the assurance methodology, review standards and assurance register, and manage reviewer capacity against demand. Accountable for pre-production architecture review, technical consultation and BAU design assurance.

About the team: Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.

What makes this role different. You lead an eight-person practice that issues binding go/no-go determinations on tools before they reach production — and you assure against architecture standards written elsewhere in Cyber Architecture and Solutions, which you do not own and must not rewrite. That separation is what makes the review worth anything, and it will be tested by programmes with committed go-live dates. Coverage spans every Cyber Architecture and Solutions domain including Cryptography and AI Security, so you need enough architecture literacy to arbitrate a finding in a domain you have never personally built in. The practice is subject to internal audit and regulatory inspection, and the assurance register and finding classification are yours to defend.

Key responsibilities:

• Lead the Design Assurance practice of eight and own its capability plan across every Cyber Architecture and Solutions domain, including Cryptography and PQC and AI Security.
• Issue binding go/no-go determinations on tools before production, and own the consequences when a programme with a committed date does not get the answer it wanted.
• Approve the assurance methodology, review standards and the Critical, High, Medium and Low classification scheme, and defend both under audit.
• Verify against architecture standards set elsewhere in Cyber Architecture and Solutions and write none of them, because that separation is what makes the assurance opinion worth anything.
• Manage reviewer capacity and tiering so high-risk designs get full review and low-risk change moves through pattern-based self-attestation with sampling.
• Assure vendor-delivered designs to exactly the same standard as internally delivered ones, including configuration handed over under the managed service model.
• Own pre-production architecture review, technical consultation and BAU design assurance across the estate.
• Feed recurring findings back to the architecture domains as standards gaps rather than reviewing the same defect repeatedly.
• Own assurance throughput, turnaround, first-time-pass and defect escape metrics, and defend them under challenge.
• Lead the practice's response to internal audit and regulatory inspection, including the evidence that reviews operated rather than merely existed.
• Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK's Responsible AI, privacy and security requirements.

Basic Qualifications:

• 15+ years in cyber security, including leading technical or specialist teams — domain focus: independent Design Assurance across all Cyber Architecture and Solutions security domains, including Cryptography and AI Security.
• Leading an independent design assurance practice — methodology, review standards and assurance register — issuing binding go/no-go decisions on tools pre-production and in BAU.
• Protecting independence from architecture under programme pressure — verifying against standards owned elsewhere, never writing them, and assuring vendor-delivered designs to the same standard as internal ones.
• Sponsoring automation of review intake, evidence capture, drift checks and reporting, managing reviewer capacity against demand and feeding recurring findings back as standards gaps.
• Assuring AI-enabled tools and agentic solutions against AI security standards, and using AI to accelerate review and evidence capture.
• Assuring AI-enabled tools and agentic solutions against AI security standards, including the evidence standard an AI-assisted review must still meet.

Preferred Qualifications:

• Architecture literacy to challenge senior architects' designs without owning the standards.
• Evidencing assurance to internal audit and regulators, including GxP documentation standards — using automated evidence capture and reporting.
• Developing and leading a team of senior reviewers and analysts.
• Executive stakeholder influence — holding a contested finding with senior leaders.
• Experience defending an assurance opinion to an audit committee or a regulator when the first line disagreed with it.

Qualifications:

Bachelor's degree in a relevant discipline, or equivalent professional experience.

Typical tools and technologies:

• Design assurance methodology
• review standards and assurance register
• finding classification and assessment scoring
• architecture review tooling
• SABSA or TOGAF reference models
• ServiceNow workflow
• Power BI for assurance metrics
• GxP-compliant documentation and evidence management

#AGTech Skills

• AI Agent Security
• AI for Cybersecurity
• Application Security
• Central Authentication Service (CAS)
• Cloud Security
• Computer Programming
• Cryptography
• Data Security
• Design Assurance
• Identity Access Management (IAM)
• Independent Decision-Making
• Information Systems
• Infrastructure Security
• ML Security
• Operating Systems Security
• Scripting
• Security Engineering
• Security Technologies
• Security Testing
• Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive. We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process. Please contact our Recruitment Team at [e-mail] to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.