Senior Principal - Design Assurance & Product Management - Security Products

14260 GSK India Global Services Private Limited; Bengaluru; On-site; INR 3,500,000 - 7,000,000; Full time

Job summary

GSK is seeking an experienced product owner for Data Security and Cloud/SaaS security tool domains. You will own the full product lifecycle, translating threat intelligence and regulatory requirements into capability use cases, and collaborating with Security Architecture to design solutions.

You will lead vendor evaluation, drive investment value, and steer decommission decisions, while coaching analysts in product management and promoting responsible AI use in security workflows.

Qualifications

• 15+ years in cyber security within regulated environments.
• Experience owning Data Security and Cloud/SaaS tools roadmap incl. GDPR/GxP.
• Vendor evaluation, SLA management for managed services.
• Collaborates with Security Architecture and engineering squads.

Responsibilities

• Own end-to-end product lifecycle for data security domains.
• Translate threat intel and compliance into use cases.
• Coordinate with Security Architecture on design.
• Own 1–3 year roadmap aligned to GDPR, GxP and cloud adoption.
• Lead vendor evaluation for data security tooling.
• Manage vendor delivery and SLA performance.
• Track investment value against regulatory coverage.
• Run product governance forum and maintain audit trails.

Skills

Data Security

Cloud Security

Product Ownership

AI Data Security

DLP & Classification

GxP Compliance

Vendor Governance

Roadmapping ROI

Regulatory Alignment

Education

Bachelor's degree in a relevant discipline

Tools

Microsoft Purview

Power BI

ServiceNow

DLP Tooling

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges. Domain focus: Security products for Data Security and Cloud/SaaS Security. Job Purpose: End‑to‑end product owner for the Data Security and Cloud/SaaS security tool domains. You run the full product lifecycle: translating threat intelligence and compliance requirements into capability use cases, coordinating with Security Architecture on solution design, leading vendor evaluation, tracking investment value against regulatory and threat coverage, and driving decommission decisions. About the team: Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK’s security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles. What makes this role different. Your controls sit directly on regulated personal and clinical data, so a DLP policy change is a privacy decision as well as a security one and you will defend the roadmap to the Data Protection Office and to GxP quality as often as to the CISO. The threat driver is identity rather than perimeter — OAuth consent abuse, over‑permissioned service principals and token theft against SaaS tenants — which is why CIEM entitlement reduction and SSPM drift sit ahead of new detection content. You own the product and the investment; Data Security Architecture owns the standards.

Key responsibilities

• Own the end-to-end product lifecycle for the Data Security and Cloud/SaaS security tool domains.
• Translate data security threat intelligence and compliance requirements into capability use cases.
• Coordinate with Security Architecture on solution design, bringing the product and commercial view to their technical one.
• Own a one to three year roadmap of investments and retirements aligned to data protection regulation including GDPR and GxP, and to cloud adoption patterns across GSK.
• Lead vendor evaluation for data security and cloud/SaaS tooling.
• Manage vendor delivery and SLA performance for the platforms in scope.
• Track investment value against regulatory and threat coverage rather than delivery milestones alone.
• Own adoption as a coverage figure — the share of the sanctioned SaaS estate under SSPM, and the share of regulated data stores labelled and under Microsoft Purview policy — and act when a business unit opts out.
• Drive decommission and consolidation decisions across the product set.
• Run the product governance forum and keep decisions and rationale traceable for audit.
• Lead your team in using approved AI tools to improve productivity and ways of working, role‑modelling responsible use and follow GSK's Responsible AI, privacy and security requirements.
• Coach domain analysts and peers in product management practice, and prove value on a contained scope before scaling a capability across the estate.

Basic Qualifications

• 15+ years in cyber security in a regulated environment — domain focus: security products for Data Security and Cloud/SaaS Security End-to-end product ownership of Data Security and Cloud/SaaS security tools — 1-3 year roadmaps aligned to GDPR, GxP and cloud adoption, with gap and duplication analysis driving consolidation
• Vendor evaluation, selection and SLA management under a managed service with automated performance reporting, and data ingestion requirements for the data fabric validated for quality and completeness
• Working in parallel with the Security Solution Engineering squad for Data Security and Cloud/SaaS Security — aligning use cases and roadmaps to build, test and vendor handover plans
• Product ownership of AI data security controls — DLP and classification for GenAI and copilots, AI-SPM and protection of data flowing into LLMs

Preferred Qualifications

• DLP, data classification, CSPM and CIEM tooling knowledge
• Portfolio analytics and ROI modelling — including automated dashboards
• Vendor governance rhythm including QBRs
• Regulated industry experience, including GxP
• Submitting new tooling to independent Design Assurance on the published intake route and resolving findings without negotiating the classification.

Qualifications

Bachelor's degree in a relevant discipline, or equivalent professional experience.

Typical tools and technologies: Data security tooling including Microsoft Purview, DLP and encryption and key management, cloud and SaaS security tooling across CSPM, CASB and SSPM, product roadmapping and adoption metrics, GDPR and GxP compliance drivers, vendor evaluation and proof-of-value, ServiceNow, Power BI.

#AGTech Skills

AI for Cybersecurity, Application Security, Cloud Computing SaaS, Cloud Security, Compliance Requirements, Computer Programming, Database Security, Data Security, Data Security Law, Identity Access Management (IAM), Information Systems, Infrastructure Security, ML Security, Operating Systems Security, Product Management, Scripting, Security Engineering, Security Technologies, Security Testing, Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK: As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process. Please contact our Recruitment Team at [e-mail] to discuss your needs.