Principal - Design Assurance & Product Management - Cryptography & PQC

14260 GSK India Global Services Private Limited; Bengaluru; On-site; INR 4,200,000 - 6,000,000; Full time

Job summary

GlaxoSmithKline plc in Bengaluru seeks a senior security professional to own the Design Assurance methodology library and act as the specialist reviewer for cryptography and AI security. You will maintain templates, scoring systems, evidence requirements and classification criteria, aligning with architecture standards.

You will also conduct specialist domain reviews for cryptography (HSM, PKI, TLS) and AI security, ensuring compliant implementations and robust risk controls across platforms.

Qualifications

• Bachelor's degree in a relevant discipline.
• Extensive design assurance knowledge with cryptography & PQC.
• Strong AI security review capabilities and ATT&CK/OWASP exposure.

Responsibilities

• Own the DA methodology library: templates, scoring, evidence requirements, finding classification.
• Run annual methodology calibration to ensure consistency across reviews.
• Perform specialist domain reviews in cryptography and AI security.
• Translate new standards into assessment criteria for consistent application.
• Develop assessment approaches for emerging technologies.
• Mentor analysts on methodology and reviews.
• Record findings clearly for actionable remediation.
• Escalate contested findings and ensure audit-ready records.

Skills

Design Assurance

Cryptography

PQC

AI Security

Security Reviews

Vendor Governance

Mentoring

Automation scripting

Education

Bachelor's degree in a relevant discipline

Tools

HSM

PKI

TLS

MITRE ATLAS

OWASP Top 10 for LLM

ISO 27001

NIST SP 800-53

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges. Domain focus: Design Assurance for Cryptography & PQC and AI Security.

Job Purpose

Senior individual contributor with two distinct responsibilities: owning the Design Assurance methodology library, and performing the specialist domain reviews nobody else in the practice can cover — cryptography and post-quantum, and AI security.

About the team

Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK’s security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles. What makes this role different. Two distinct jobs in one role. You own the Design Assurance methodology library — review templates, scoring criteria, evidence requirements and finding classification — and keep it current as architecture standards change. Alongside that you are the specialist reviewer for the two domains nobody else can cover: cryptography, including key management, HSM, PKI and TLS review and the post-quantum migration to CRYSTALS-Kyber and CRYSTALS-Dilithium; and AI security, reviewing against MITRE ATLAS and the OWASP Top 10 for LLM Applications. Depth in one of those two is essential; depth in both is rare and will stand out.

Key responsibilities

• Own the Design Assurance methodology library: review templates, assessment scoring criteria, evidence requirements and finding classification.
• Run the annual methodology calibration: re-score a sample of closed reviews across reviewers to prove that a High finding means the same thing whoever raised it, and correct the criteria where it does not.
• Perform specialist domain reviews in niche areas including cryptography and AI, where generalist review is not credible.
• Translate new or changed architecture standards into assessment criteria the practice can apply consistently.
• Develop assessment approaches for emerging technology types before they arrive in the review queue.
• Advise reviewers on how to apply the methodology in ambiguous cases.
• Convert published architecture standards into assessment criteria, and return ambiguity in a standard to its owning domain as a defect rather than resolving it by writing the missing wording.
• Record findings clearly enough to be acted on without further interpretation.
• Escalate contested findings rather than negotiating them away.
• Mentor analysts on methodology and review practice.
• Use approved AI tools in your day-to-day work to improve your own productivity and your team’s ways of working, sharing what works and applying sound judgement, including validating outputs and following GSK’s Responsible AI, privacy and security requirements.
• Hold assurance evidence to GxP and data integrity expectations, so the review record stands up to audit and regulatory inspection.

Basic Qualifications

• 10+ years in cyber security — domain focus: Design Assurance for Cryptography & PQC and AI Security Owning the DA methodology library and vendor assurance playbook — templates, scoring, evidence requirements, finding classification, test scenarios and acceptance criteria — automated where possible
• Leading design assurance reviews for Cryptography & PQC, validating control implementations and migration outputs against architecture standards
• Leading design assurance reviews for AI Security — prompt-injection defences, guardrails, model access, agent tool-calling scope and AI data protection
• Senior review lead for complex and cross-domain reviews, peer-reviewing analyst outputs and running in-life health checks on critical tools

Preferred Qualifications

• Cryptography, key management and PQC migration knowledge
• AI platform security controls and threat modelling
• Assurance and control-assessment frameworks — ISO 27001 Annex A, NIST CSF and NIST SP 800-53 — applied as review criteria rather than cited as background.
• Scripting or tooling to automate review evidence and template maintenance
• Updating Design Assurance assessment criteria whenever architecture standards change

Qualifications

Bachelor's degree in a relevant discipline, or equivalent professional experience. Typical tools and technologies: Design assurance methodology library, review templates and assessment scoring, cryptographic standards and key management review across HSM, PKI and TLS, post-quantum cryptography including CRYSTALS-Kyber and CRYSTALS-Dilithium, AI security review using MITRE ATLAS and the OWASP Top 10 for LLM Applications, evidence requirements and acceptance criteria.

#AGTech Skills

AI for Cybersecurity, Application Security, Cloud Security, Computer Programming, Cryptography, Data Security, Design Assurance, Identity Access Management (IAM), Information Systems, Infrastructure Security, In-Process Quality Control (IPQC), ML Security, Operating Systems Security, Platform Security, Scripting, Security Engineering, Security Technologies, Security Testing, Threat Modeling, Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases - to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process. Please contact our Recruitment Team at [e-mail].

We are a global biopharma company with a special purpose - to unite science, technology and talent to get ahead of disease together - so we can positively impact the health of billions of people and deliver stronger, more sustainable shareholder returns - as an organisation where people can thrive. Getting ahead means preventing disease as well as treating it, and we aim to impact the health of 2.5 billion people around the world in the next 10 years. Our success absolutely depends on our people. While getting ahead of disease together is about our ambition for patients and shareholders, it’s also about making GSK a place where people can thrive. We want GSK to be a place where people feel inspired, encouraged and challenged to be the best they can be. A place where they can be themselves - feeling welcome, valued and included. Where they can keep growing and look after their wellbeing. So, if you share our ambition, join us at this exciting moment in our journey to get Ahead Together. Find out more on our career site.