US GRC & Information Security Strategy Lead

Biopharma Careers; Boston (MA); Hybrid; USD 179,000 - 212,000; Full time

Job summary

Servier in the U.S. is hiring an Associate Director, Information Security Governance, Risk and Compliance, a senior leader who will shape the GRC program across the US affiliate.

You will partner with Global Information Security, IT, Legal, Privacy, Procurement, Quality and Internal Audit to translate security risk into business impact and drive risk-informed decisions. This role leads governance, policy, third‑party risk, audit readiness, and risk reporting, managing managers and specialists.

Qualifications

• Minimum of 8+ years in information security GRC, risk management, or related fields.
• Minimum of 3+ years in a leadership role with program ownership or people leadership.
• Bachelor's degree in Cybersecurity, IT, Information Systems, Business, Risk Management, or related.
• Deep expertise in risk frameworks (NIST CSF, ISO 27001, PCI, SOX, FAIR) and policy governance.
• Experience leading third-party risk, audit readiness, and remediation governance.

Responsibilities

• Establish and lead the US information security risk management framework.
• Define risk assessment methodologies, taxonomy, scoring, reporting, and escalation.
• Oversee risk assessments and ensure alignment with enterprise risk expectations.
• Lead governance routines, cadence, reporting, and execution for US GRC.
• Oversee policy lifecycle, controls, assurance, and remediation governance.
• Partner with Internal Audit, Legal, Privacy, IT, and Quality for assurance.

Skills

GRC leadership

Information security

Risk management

Policy governance

Compliance

Audit readiness

Executive communication

Third-party risk

Education

Bachelor's degree

Job description

Servier in the U.S. is hiring an Associate Director, Information Security Governance, Risk and Compliance, a senior leader who will shape the GRC program across the US affiliate.

You will partner with Global Information Security, IT, Legal, Privacy, Procurement, Quality and Internal Audit to translate security risk into business impact and drive risk-informed decisions. This role leads governance, policy, third‑party risk, audit readiness, and risk reporting, managing managers and specialists.