Associate Director - Systems Risk

GSK; Bengaluru; On-site; INR 3,500,000 - 7,000,000; Full time

Job summary

GSK is seeking an Associate Director, Systems Risk to lead the application and systems risk capability within the Risk Operations Centre. You will build continuous control monitoring, assess risk across critical systems, and provide assurance to inform risk treatment decisions.

You will partner with multiple teams to mature risk data, dashboards and governance. The role requires broad experience in cyber security, risk assessment and enterprise architecture, with leadership in delivering complex

Qualifications

• Degree or related experience in technology risk, cybersecurity or risk management.
• Experience in technology or application risk assessment and control evaluation.
• Knowledge of threat landscapes and enterprise systems risk.
• Experience with risk registers and continuous monitoring.

Responsibilities

• Lead continuous control monitoring across critical applications and systems.
• Assess risk and provide assurance over controls to inform risk treatment.
• Conduct detailed risk assessments and act as SME on systems security.
• Advise owners on required controls and associated risk.
• Maintain and update the system risk register as the estate changes.
• Partner with Risk Intelligence, Automation and business partners for data and dashboards.
• Influence security capability roadmaps and remediate risks to closure.
• Track remediation progress and feed risk themes into policy and architecture.

Skills

Application Risk Assessment

Cloud Security

Control Monitoring

Cybersecurity

Data Integrity

Executive Reports

Identity Access Management

Internal Control Evaluation

Risk Assessments

Risk Management

Risk Management Framework

Security Architecture Design

Security Compliance

Security Policies

Security Risk

Technical Risk Assessment

Third Party Risk Management

Threat Analysis

Vulnerability Management

Web Application Security

Education

Degree in a relevant discipline

Tools

ServiceNow

GRC tooling

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Job Purpose

The Associate Director, Systems Risk leads the application and systems risk capability within GSK's Risk Operations Centre, reporting to the Director, Risk Detection & Response. This role builds continuous control monitoring of applications and systems to assess control operating effectiveness and provide risk assurance, grounded in a deep understanding of the evolving threat landscape and the business context and architecture of GSK's critical systems.

About the team

Systems Risk provides the continuous monitoring, control assurance and risk assessment that GSK's business-facing Technology Risk and Compliance teams and the wider Risk Operations Centre rely on to understand and manage the risk carried by GSK's critical business applications and systems, from onboarding through change to decommissioning.

Key responsibilities

• Build and maintain a deep understanding of the evolving threat landscape relevant to GSK's critical business applications and systems, as well as their business context and architecture.
• Build and run continuous control monitoring across applications and systems to provide ongoing visibility into control operating effectiveness, synthesising system understanding and threat intelligence into a holistic, continuous view of risk.
• Assess risk and provide assurance over application and system controls, informing risk treatment and prioritisation decisions.
• Lead ad hoc, detailed risk assessments of applications and systems, acting as subject matter expert on systems and application security and controls.
• Advise system and application owners on the controls their systems require and the risk they carry.
• Maintain the system risk register and keep it current as the estate changes.
• Partner closely with the Risk Intelligence and Automation team on gathering, automating and visualising application and systems risk data.
• Partner with the business-facing Technology Risk and Compliance Business Partners teams who own the business relationship, providing them with the data, risk assessments and assurance they need to engage system and business owners effectively.
• Influence the roadmap of teams building out the security capabilities needed to defend GSK's business systems and applications.
• Track system remediation and risk treatment through to closure.
• Feed systemic and cross-system risk themes back into policy, architecture and the wider Risk Operations Centre.

Basic Qualifications

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in technology or application risk assessment, control evaluation or information security risk.
• Strong understanding of the evolving threat landscape relevant to enterprise business systems and applications.
• Working knowledge of enterprise system and application architecture, with the ability to understand the business context of critical systems.
• Experience building or operating continuous control monitoring for applications or systems.
• Practical experience with risk register management.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality and timelines.
• Excellent relationship management, influencing and communication skills, including the ability to influence the roadmap of other teams.

Preferred Qualifications

• Working knowledge of NIST CSF, NIST 800-53 and ISO 27001.
• Experience assessing risk across the system lifecycle.
• Experience with GRC tooling such as ServiceNow.
• Experience in a regulated industry, including GxP systems.
• Experience partnering with data, analytics or automation teams to build continuous control monitoring, dashboards or risk indices.
• Familiarity with enterprise architecture frameworks or application security standards (e.g., OWASP, SANS Top 25).
• Relevant certification such as CRISC, CISA, CISM, CISSP.
• Experience in pharmaceutical, life sciences or another highly regulated industry.

Skills

Application Risk Assessment, Cloud Security, Control Monitoring, Cybersecurity, Data Integrity, Executive Reports, Identity Access Management (IAM), Internal Control Evaluation, Risk Assessments, Risk Management, Risk Management Framework, Security Architecture Design, Security Compliance, Security Policies, Security Risk, Technical Risk Assessment, Third Party Risk Management, Threat Analysis, Vulnerability Management, Web Application Security

Why GSK?

Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process. Please contact our Recruitment Team at [e-mail] to discuss your needs.

We are a global biopharma company with a special purpose – to unite science, technology and talent to get ahead of disease together – so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns – as an organisation where people can thrive.

We want GSK to be a place where people feel inspired, encouraged and challenged to be the best they can be. A place where they can be themselves – feeling welcome, valued and included. Where they can keep growing and look after their wellbeing. So, if you share our ambition, join us at this exciting moment in our journey to get Ahead Together.

Find out more on our career site.