Principal - Design Assurance & Product Management - Pre-production

14260 GSK India Global Services Private Limited; Bengaluru; On-site; INR 3,000,000 - 6,000,000; Full time

Job summary

GlaxoSmithKline plc is seeking a Senior Design Assurance Architect to lead pre-production reviews for Tier1 tools and cross‑domain security architectures. You will own threat modelling, risk assessment, and independent architecture challenges across cloud, network, platform, data, and AI security domains.

The role emphasizes vendor deliverable assurance, applying rigorous standards and mentoring junior analysts.

Qualifications

• 10+ years in cyber security with deep security architecture expertise
• Leading design assurance reviews of complex, high-risk Tier1 tools across all domains
• Vendor deliverable assurance — validating vendor‑delivered configurations against the design specification
• Independent challenge of architecture designs before build
• Leading design assurance of AI tools and agentic solutions
• GxP‑compliant documentation and evidence management

Responsibilities

• Lead design assurance reviews for Tier1 and high-risk tools across Cyber Architecture and Solutions domains
• Run threat modelling and architecture risk assessment yourself
• Act as primary technical reviewer for vendor deliverable assurance
• Conduct independent architecture challenge before build and escalate findings
• Set review approach for new designs and standardize into repeatable criteria
• Mentor Design Assurance analysts on review technique and evidence quality

Skills

Security architecture

Threat modelling

Architecture governance

Cloud security

AI security

Security engineering

Scripting

Education

Bachelor’s degree in a relevant discipline

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: Design Assurance Tier 1 and cross-domain reviews.

Job Purpose

Senior individual contributor leading design assurance reviews for complex and high-risk tools across all domains — the most technically demanding reviews in the practice. You own pre-production review leadership for Tier 1 tools and are the primary technical reviewer for vendor deliverable assurance.

About the team

Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model.

Seventeen roles.

What makes this role different.

You take the reviews nobody else can — Tier1 tools and cross-domain designs where the security architecture is genuinely hard and the finding will be contested. That means real depth across cloud, network, platform and data security architecture, threat modelling you can run yourself, and the confidence to tell an expert architect their design does not meet a standard. You also lead vendor deliverable assurance, formally validating that what the managed service vendor configured matches the Cyber Architecture and Solutions design specification. No line management; your authority comes entirely from the quality of the review.

Key responsibilities

• Lead design assurance reviews for Tier1 and high-risk tools across every Cyber Architecture and Solutions domain — cloud, network and Zero Trust, platform and detection, data security, application security, OT and AI.
• Run threat modelling and architecture risk assessment yourself on the designs you review, rather than relying on the submitting team’s assessment.
• Act as primary technical reviewer for vendor deliverable assurance, validating that vendor-delivered platform configurations match the Cyber Architecture and Solutions design specification before acceptance.
• Take the reviews the domain analysts elevate: designs spanning more than one architecture domain, designs with no review precedent, and any design where an analyst’s finding is formally contested by the submitting architect.
• Conduct independent architecture challenge on design outputs before they go to build, and tell an expert architect their design does not meet a standard when it does not.
• Set the review approach for designs that arrive without precedent, and have it adopted into the published methodology so a one-off judgement becomes a repeatable criterion rather than a private standard.
• Raise recurring findings to the owning architecture domain as a formal standards gap with the evidence attached, and re-test once the standard is amended — without drafting the amendment yourself.
• Record findings against a specific standard clause, classified Critical, High, Medium or Low, clearly enough that teams can act without further interpretation.
• Escalate contested findings rather than negotiating them away, and own them through to remediation close‑out.
• Use approved AI tools in your day‑to‑day work to improve your own productivity and your team’s ways of working, sharing what works and applying sound judgement, including validating outputs and following GSK’s Responsible AI, privacy and security requirements.
• Mentor Design Assurance analysts on review technique and evidence quality, and review their findings before they are issued.

Basic Qualifications

• 10+ years in cyber security with deep security architecture expertise — domain focus: Design Assurance Tier1 and cross‑domain reviews
• Leading design assurance reviews of complex, high‑risk Tier1 tools across all domains, with personal accountability for review rigour and findings owned to close‑out
• Vendor deliverable assurance — validating vendor‑delivered configurations against the design specification and leading vendor acceptance testing, with automated drift detection
• Independent challenge of architecture designs before build, including from senior architects, and developing assessment criteria for AI tools, OT platforms and cloud‑native services
• Leading design assurance of AI tools and agentic solutions — guardrails, tool‑calling scope, data exposure and model risk — against AI security standards

Preferred Qualifications

• Experience holding a finding against an architect more senior than you, and the evidence trail that made it stick.
• Threat modelling and architecture risk assessment
• Scripting or policy‑as‑code for review evidence and drift checks
• Preparing evidence for internal or external audit, including GxP documentation
• Acting as the most senior reviewer in the practice, verifying against standards owned elsewhere

Qualifications

Bachelor’s degree in a relevant discipline, or equivalent professional experience.

Typical tools and technologies

• Architecture review and threat modelling
• security design standards libraries
• configuration review across cloud, network, platform and data security tooling
• vendor deliverable assurance
• evidence requirements and finding classification
• GxP‑compliant documentation

#AGTech Skills

• AI for Cybersecurity
• Application Security
• Architecture Governance
• Architecture Strategy
• Cloud Security
• Computer Programming
• Data Security
• Design Assurance
• Identity Access Management (IAM)
• Information Systems
• Infrastructure Security
• ML Security
• Operating Systems Security
• Scripting
• Security Architecture Design
• Security Engineering
• Security Technologies
• Security Testing
• Threat Modeling
• Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people. Inclusion at GSK: As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process. Please contact our Recruitment Team at [e-mail] to discuss your needs. We want GSK to be a place where people feel inspired, encouraged and challenged to be the best they can be. A place where they can be themselves – feeling welcome, valued and included. Where they can keep growing and look after their wellbeing. So, if you share our ambition, join us at this exciting moment in our journey to get Ahead Together.