GRC Compliance Senior Analyst

Novartis; North Carolina; Hybrid; USD 109,000 - 202,000; Full time

Job summary

Novartis seeks a seasoned GRC Compliance Senior Analyst to support information security, risk, and governance across business applications, IT/OT services, and manufacturing sites in a hybrid Durham, NC environment. You will drive compliance programs and audit readiness while partnering with global teams.

With 8+ years in security and risk, you will guide controls, classifications, and policy adherence, leveraging AI to enhance efficiency.

Qualifications

• 8+ years in Business Information Security and Compliance, IT Risk, Audit management.
• University degree in business/technical/scientific area or comparable education/experience.
• Experience with managing risks, vulnerabilities and issues within the function; strong stakeholder engagement.

Responsibilities

• Provide ISC governance and risk advice for Operations IT and OT globally; oversee a governance/risk area.
• Monitor information risk and guide risk-based treatment of threats and vulnerabilities.
• Deliver global information governance programs: risk management, data classification, storage & transmission guidelines, audit readiness support.
• Maintain knowledge of internal controls and risk frameworks; support implementation and monitoring.
• Provide KPI reporting, dashboards, and continuous improvements to ensure compliance.
• Analyze impact of new technologies and regulatory changes on information security, including Cyber Security and Data Privacy laws.
• Communicate and collaborate with Service Delivery Teams and partners; drive business value.
• Leverage AI and automation to streamline compliance activities, including risk assessments and audit support.

Skills

InfoSec governance

Risk management

GRC

Stakeholder management

Strong communication

English proficiency

Education

Bachelor's degree or higher in business/technical/scientific field

Job description

Job Description Summary

Location: Durham,(North Carolina), US #LI-Hybrid 3 days/week in office

Internal job title: Sr. Spec. DDIT ISC Operations

About the Role

The GRC Compliance Senior Analyst and support information security, risk, and compliance activities across business applications, IT/OT services, and manufacturing sites. The role will ensure solutions are designed, developed, and operated in accordance with organizational security standards, regulatory requirements, and governance frameworks. They will drive continuous improvement of security compliance programs, strengthen risk management practices, and maintain audit and inspection readiness.

Job Description

Key Responsibilities

• Provide ISC governance/risk advice and support for Operations IT and OT Function and oversee a specific governance/risk area globally. Ensure IT/OT project risks are managed in line with ISC strategy, the policy framework, laws and regulations and industry standards.
• Ensure monitoring of information risk and proactive mitigation of issues. Continuous support risk-based treatment of threats, issues and vulnerabilities. Guide teams and support them in understanding the risk exposure and technical safeguards.
• Deliver global information governance programs like risk management, data classification, storage & transmission guidelines, audit readiness support, etc.
• Maintain strong knowledge of internal controls and internal risk and control frameworks/standards or the Information Management Policy Framework. Systematically support implementation and monitoring of the same.
• Provide KPI reporting, dashboards, and continuous improvements to ensure compliance.
• Analyse impact of new technologies and regulatory changes on information security considering Cyber Security and Data Privacy Acts, Laws, and Regulations
• Ensure good communication and collaboration with the Service Delivery Teams of the DDIT operations and other support partners. Share new ideas, be proactive and have desire to deliver business value.
• Leverage AI and automation to streamline compliance activities, including risk assessments, control documentation, testing, issue management, and audit support.

Essential Requirements

• Over 8+ years of experience in Business Information Security and Compliance, IT Risk management, Audit management, Information Governance and Management, GRC
• University degree in business/technical/scientific area or comparable education/experience
• Extensive knowledge and experience to efficiently manage risks, vulnerabilities and Issues within the function.
• Disciplined approach in managing the functional & operational risks, successful engagement with stakeholders, advocacy to drive Information Security Compliance activities.
• Demonstrated ability to collaborate effectively and build successful partnerships with key stakeholders, vendors, support teams, and internal cross-functional teams.
• Experience with Good Practice Quality guidelines and regulations (GxP)
• Strong stakeholder management skills (Senior Business Execs, IT Site Heads, etc.)
• Excellent communication skills with proficiency in English (written and spoken)

Desirable requirements

• Experience with OT security compliance and implementing policies in manufacturing setup, ideally in pharma
• AI knowledge and experience
• A professional Information Security certifications, either from ISACA like CISM, CRISC, CISA and/or ISC2 like CISSP, CCSP, etc.

Commitment to Diversity & Inclusion

We are committed to building an outstanding, inclusive work environment and diverse teams representative of the patients and communities we serve.

Why Novartis

Our purpose is to reimagine medicine to improve and extend people's lives and our vision is to become the most valued and trusted medicines company in the world. How can we achieve this? With our people. It is our associates that drive us each day to reach our ambitions.

The salary for this position is expected to range between $108,500 and $ 201,500 per year. The final salary offered is determined based on factors like, but not limited to, relevant skills and experience, and upon joining Novartis will be reviewed periodically. Novartis may change the published salary range based on company and market factors. Your compensation will include a performance-based cash incentive and, depending on the level of the role, eligibility to be considered for annual equity awards. US-based eligible employees will receive a comprehensive benefits package that includes health, life and disability benefits, a 401(k) with company contribution and match, and a variety of other benefits.