GRC Assurance Partner

Sandoz India; Telangana; Hybrid; INR 1,800,000 - 3,000,000; Full time

Benefits offered by this job

Competitive compensation

Flexible/hybrid working

Health & wellness benefits

Learning & development programs

Global career opportunities

Inclusive culture

Job summary

Sandoz India seeks an experienced Information Security / Risk Compliance leader to steward the ISRC program across regions and product domains. You will guide security requirements with business and technology stakeholders, drive governance frameworks, and oversee remediation of findings and risk exceptions.

An emphasis on executive reporting and cross-functional collaboration is required. The role requires deep knowledge of ISO 27001, NIST, and CIS Controls, with 15+ years in information

Qualifications

• Bachelor’s degree or equivalent experience in Computer Science, Information Technology, Engineering, or related discipline.
• Minimum 15 years of experience in information security, technology risk management, or related field.
• Proven experience partnering with business and technology teams across regional or enterprise portfolios.
• Strong knowledge of information security frameworks and standards such as ISO 27001, NIST, and CIS Controls.
• Experience applying security and risk management principles across product development, cloud environments, and third-party ecosystems.
• Demonstrated ability to manage governance processes, risk assessments, audits, compliance activities, and executive reporting.
• Strong program and project management capabilities with experience handling multiple priorities and stakeholders.
• Ability to translate technical security risks into business impact and influence decision-making at multiple organizational levels.
• Essential Skills: Excellent communication, stakeholder management, consulting, collaboration, and continuous improvement mindset with ability to influence without direct authority.
• Languages: Fluent written and spoken English.
• Professional certifications such as CISSP, CISM, CISA, or equivalent information security credentials.
• Experience with privacy regulations, regulatory compliance requirements, and pharmaceutical industry environments.

Responsibilities

• Serve as the primary ISRC contact for assigned regions and supported product domains/functions, providing practical guidance on security, compliance, and risk-related matters.
• Partner with business and technology leadership to define security requirements, support prioritization, and promote risk-based decision-making.
• Drive the adoption and consistent implementation of ISRC processes, controls, and governance frameworks across supported areas.
• Manage the security and compliance posture of technology assets and services, ensuring ownership, accountability, and adherence to defined security requirements.
• Support security control implementation by advising on control design, facilitating evidence collection, and coordinating with control owners and security architects.
• Manage control deficiencies and security findings through remediation, tracking, validation, and timely closure.
• Administer the risk exception process, ensuring appropriate approvals, compensating controls, periodic reviews, and remediation activities.
• Support audits, compliance assessments, asset classification activities, third-party risk reviews, and security awareness initiatives while providing executive-level security reporting and metrics.
• KPI: Percentage of security findings, control deficiencies, and risk exceptions closed within agreed timelines.

Skills

Information security

Risk management

Governance

Stakeholder management

Communication

Project management

Cloud security

ISO 27001 knowledge

NIST

CIS Controls

English proficiency

Education

Bachelor’s degree in Computer Science / IT / Engineering

Tools

ISO 27001

NIST

CIS Controls

CISSP

CISM

CISA

Job description

Your Key Responsibilities

Your responsibilities include, but not limited to:

• Serve as the primary ISRC contact for assigned regions and supported product domains/functions, providing practical guidance on security, compliance, and risk-related matters.
• Partner with business and technology leadership to define security requirements, support prioritization, and promote risk-based decision-making.
• Drive the adoption and consistent implementation of ISRC processes, controls, and governance frameworks across supported areas.
• Manage the security and compliance posture of technology assets and services, ensuring ownership, accountability, and adherence to defined security requirements.
• Support security control implementation by advising on control design, facilitating evidence collection, and coordinating with control owners and security architects.
• Manage control deficiencies and security findings through remediation, tracking, validation, and timely closure.
• Administer the risk exception process, ensuring appropriate approvals, compensating controls, periodic reviews, and remediation activities.
• Support audits, compliance assessments, asset classification activities, third-party risk reviews, and security awareness initiatives while providing executive-level security reporting and metrics.
• KPI: Percentage of security findings, control deficiencies, and risk exceptions closed within agreed timelines.

Essential Requirements

What you'll bring to the role:

• Bachelor’s degree, or equivalent experience, in Computer Science, Information Technology, Engineering, or a related discipline.
• Minimum 15 years of experience in information security, technology risk management, or a related field.
• Proven experience partnering with business and technology teams across regional or enterprise portfolios.
• Strong knowledge of information security frameworks and standards such as ISO 27001, NIST, and CIS Controls.
• Experience applying security and risk management principles across product development, cloud environments, and third-party ecosystems.
• Demonstrated ability to manage governance processes, risk assessments, audits, compliance activities, and executive reporting.
• Strong program and project management capabilities with experience handling multiple priorities and stakeholders.
• Ability to translate technical security risks into business impact and influence decision-making at multiple organizational levels.
• Essential Skills: Excellent communication, stakeholder management, consulting, collaboration, and continuous improvement mindset with the ability to influence without direct authority.
• Languages: Fluent written and spoken English.
• Professional certifications such as CISSP, CISM, CISA, or equivalent information security credentials.
• Experience with privacy regulations, regulatory compliance requirements, and pharmaceutical industry environments.

Your Key Responsibilities

Your responsibilities include, but not limited to:

• Serve as the primary ISRC contact for assigned regions and supported product domains/functions, providing practical guidance on security, compliance, and risk-related matters.
• Partner with business and technology leadership to define security requirements, support prioritization, and promote risk-based decision-making.
• Drive the adoption and consistent implementation of ISRC processes, controls, and governance frameworks across supported areas.
• Manage the security and compliance posture of technology assets and services, ensuring ownership, accountability, and adherence to defined security requirements.
• Support security control implementation by advising on control design, facilitating evidence collection, and coordinating with control owners and security architects.
• Manage control deficiencies and security findings through remediation, tracking, validation, and timely closure.
• Administer the risk exception process, ensuring appropriate approvals, compensating controls, periodic reviews, and remediation activities.
• Support audits, compliance assessments, asset classification activities, third-party risk reviews, and security awareness initiatives while providing executive-level security reporting and metrics.
• KPI: Percentage of security findings, control deficiencies, and risk exceptions closed within agreed timelines.

Essential Requirements

What you'll bring to the role:

• Bachelor’s degree, or equivalent experience, in Computer Science, Information Technology, Engineering, or a related discipline.
• Minimum 15 years of experience in information security, technology risk management, or a related field.
• Proven experience partnering with business and technology teams across regional or enterprise portfolios.
• Strong knowledge of information security frameworks and standards such as ISO 27001, NIST, and CIS Controls.
• Experience applying security and risk management principles across product development, cloud environments, and third-party ecosystems.
• Demonstrated ability to manage governance processes, risk assessments, audits, compliance activities, and executive reporting.
• Strong program and project management capabilities with experience handling multiple priorities and stakeholders.
• Ability to translate technical security risks into business impact and influence decision-making at multiple organizational levels.
• Essential Skills: Excellent communication, stakeholder management, consulting, collaboration, and continuous improvement mindset with the ability to influence without direct authority.
• Languages: Fluent written and spoken English.
• Professional certifications such as CISSP, CISM, CISA, or equivalent information security credentials.
• Experience with privacy regulations, regulatory compliance requirements, and pharmaceutical industry environments.

Desirable Requirements

• Professional certifications such as CISSP, CISM, CISA, or equivalent information security credentials.
• Experience with privacy regulations, regulatory compliance requirements, and pharmaceutical industry environments.

You’ll Receive

• Competitive compensation and performance-related rewards.
• Flexible and hybrid working opportunities.
• Comprehensive health and wellness benefits.
• Learning and development programs to support continuous professional growth.
• Access to global career development and internal mobility opportunities.
• Inclusive, collaborative, and purpose-driven work environment focused on innovation and impact.

Why Sandoz?

Generic and Biosimilar medicines are the backbone of the global medicines industry. Sandoz, a leader in this sector, provided more than 900 million patient treatments across 100+ countries in 2024 and while we are proud of this achievement, we have an ambition to do more!

With investments in new development capabilities, production sites, new acquisitions, and partnerships, we have the opportunity to shape the future of Sandoz and help more patients gain access to low-cost, high-quality medicines, sustainably.

Our momentum is powered by an open, collaborative culture driven by our talented and ambitious colleagues, who, in return for applying their skills experience an agile and collegiate environment with impactful, flexible-hybrid careers, where diversity is welcomed and where personal growth is supported!

Join us!