Business Information Security Expert, Finance

IN10 (FCRS = IN010) Novartis Healthcare Private Limited; Hyderabad; Hybrid; INR 1,800,000 - 3,200,000; Full time

Job summary

IN10 (FCRS = IN010) Novartis Healthcare Private Limited in Hyderabad, India seeks a seasoned Business Information Security Expert (BISE) to advise on security for Finance applications across their lifecycle. You will partner with Finance, DDIT, and project teams to identify material risks and implement proportionate controls.

You will drive security by design, manage identities and data protection, assess third-party risks, and support audit activities, while translating complex security topics

Qualifications

• 8+ years of enterprise Information Security and Cybersecurity experience, including governance and controls.
• Ability to assess risk across applications, infrastructure, cloud, identity, data, AI tools and third parties.
• Strong analytical, investigative and critical-thinking skills with risk-based decision making.
• Ability to understand unfamiliar technologies and translate findings into business risk.
• Excellent written, verbal and executive communication with stakeholders.
• Ability to work autonomously while knowing when escalation is needed.
• Curiosity and ability to learn quickly in fast-moving environments.

Responsibilities

• Provide Information Security guidance for Finance applications and platforms through their lifecycle.
• Identify and communicate material security risks, vulnerabilities, and policy exceptions.
• Ensure security requirements are considered early in projects and design.
• Advise on identity, access management and data protection across systems.
• Identify and manage security risks with third-party vendors and providers.
• Support security-related audits and assurance activities for applications.
• Coordinate with security teams and translate findings into practical actions.
• Build strong relationships across Finance, DDIT and Information Security.

Skills

Information Security

Cybersecurity

Governance

Risk Assessment

Stakeholder Mgmt

Executive Communication

Cloud Security

IAM

Audit & Assurance

Regulated Environments

Job description

Job Description Summary

Location: Hyderabad, India #LI-Hybrid Internal job title: Associate Director DDIT ISC FM&A Compliance

About the Role:

Finance relies on a complex portfolio of applications and technology platforms supporting critical business processes, data and reporting. Protecting this environment requires strong Information Security expertise combined with business judgement, effective governance and close partnership with the teams that own, operate and transform these solutions. As a Business Information Security Expert (BISE) supporting Finance, you will act as a trusted Information Security adviser and business partner for a portfolio of Finance applications, platforms and initiatives. You will work with Finance, DD&IT, application owners, project teams and Information Security specialists to ensure security requirements are understood, material risks are identified and managed, and appropriate controls are incorporated throughout the application lifecycle. This is not simply about identifying control gaps or enforcing requirements. You will need to understand the technology and business context, determine what genuinely matters, translate technical findings into business risk and help stakeholders find practical, proportionate solutions.

Key Responsibilities:

• Application Security & Governance: Provide Information Security guidance and oversight for assigned Finance applications, platforms and initiatives throughout their lifecycle.
• Risk & Security Posture Management: Identify, assess and communicate material security risks, vulnerabilities, control gaps and policy exceptions, helping stakeholders prioritize and drive appropriate remediation.
• Security by Design: Engage with projects and significant application changes to ensure security requirements are considered early and appropriately incorporated into solutions.
• Identity & Data Protection: Provide guidance on security areas including identity and access management, privileged access, sensitive information, data protection and application integrations.
• Third-Party Risk: Identify and help manage security risks associated with vendors, technology providers and externally delivered services.
• Audit & Assurance: Support security-related assurance, audit and compliance activities and help application teams address identified gaps.
• Security SME Coordination: Recognize when specialist expertise is required, engage the appropriate Information Security or Cybersecurity teams and translate their findings into practical actions.
• Business Partnership: Build strong relationships across Finance, DD&IT and Information Security, constructively challenging where necessary while helping stakeholders achieve business objectives securely.
• Executive Communication: Translate complex security matters into clear business impact, recommendations and decisions.
• Continuous Improvement: Identify recurring risks and systemic weaknesses across the portfolio and help improve security governance and ways of working.

Essential Requirements:

• 8+ years of experience with strong understanding and knowledge of enterprise Information Security and Cybersecurity, with experience in compliance, governance and controls aspects.
• Ability to assess risk across applications, infrastructure, cloud, identity, data, AI tools and third parties.
• Strong analytical, investigative and critical-thinking skills, pragmatic proportionate and risk-based decision-making.
• Ability to rapidly understand unfamiliar technologies, companies and business environments, and judgement to distinguish material risk from technical noise.
• Confidence making recommendations when information is incomplete, ambiguous or evolving.
• Excellent written, verbal and executive communication skills, with strong stakeholder-management and influencing capabilities.
• Ability to work autonomously while knowing when specialist expertise or escalation is required.
• Intellectual curiosity, ability to learn quickly and comfort operating in fast-moving, complex environments.

Desirable requirements:

• Experience in Finance technology, enterprise applications, SAP, security governance, technology risk, audit and assurance, cloud security, identity and access management, third-party risk or another regulated environment is highly desirable.

Commitment to Diversity & Inclusion:

We are committed to building an outstanding, inclusive work environment and diverse teams representative of the patients and communities we serve.

Why Novartis?

Our purpose is to reimagine medicine to improve and extend people’s lives and our vision is to become the most valued and trusted medicines company in the world. How can we achieve this? With our people. It is our associates that drive us each day to reach our ambitions. Be a part of this mission and join us! Learn more here: https://www.novartis.com/about/strategy/people-and-culture

Accessibility and accommodation:

Novartis is committed to working with and providing reasonable accommodation to all individuals. If, because of a medical condition or disability, you need a reasonable accommodation for any part of the recruitment process, or in order to receive more detailed information about the essential functions of a position, please send an e-mail to and let us know the nature of your request and your contact information. Please include the job requisition number in your message.

Skills Desired Business Acumen, Compliance Management, Compliance Training, Digital Capabilities, Influencing Skills Improving the lives of people living with disease takes more than innovative science. It takes a focus on the needs of people and a community committed to meeting them. It takes a team of people like you. Working together. Learning together. Thriving together. Discover how you can join us in changing people’s lives.

In the context of China Cross-Border Data Transfer (CBDT) policy, if you need to apply for a position in China, please go to the local Recruiting System TaleNov.