Director, Cyber Risk Management & Remediation

Job Title: Director Cyber Risk Management & Remediation

GCl: F

Introduction to role:

Are you ready to turn sophisticated enterprise cyber risk into critical measurable results that protect how we run the business and deliver lifechanging medicines Can you build the security posture of core platforms and application deployment at global scale while guiding senior leaders toward the right tradeoffs!

You will engage at the earliest stages of major transformations. You will embed pragmatic controls orchestrate remediation and ensure SOX and compliance obligations are met. You will do all this while keeping delivery on track.

Embedded with platform and engineering leadership and operating as part of the enterprise cybersecurity function you will set standards governance and operating models that translate risk into prioritized defensible remediation. Your impact will be transparent in clear metrics reduced residual risk auditready evidence and resilient platforms that underpin our ability to get medicines to patients safely and efficiently.

Accountabilities:

• Risk Lifecycle Ownership: Lead the recognition evaluation management approval and supervision for the portfolio; maintain an authoritative risk register spanning SAP SDLC/DevSecOps automation workflow platforms and software supply chain with clear owners timelines and a predictable executive blocking issue cadence.
• Executive Engagement and Influence: Advise senior technology and business leaders; translate threat intelligence regulatory drivers and delivery realities into clear risk priorities and investment decisions that protect critical business processes.
• Define and run the governance model for risk acceptance exceptions and waivers. Ensure residual risk is detailed treatments are timebound and blocking issues align with enterprise appetite. Apply SOXrelevant controls and secure finance and audit participation when enterprise financial platforms are in scope.
• Control Baseline and Framework Mapping: Set and carry out defensible control baselines across SAP SDLC/DevSecOps RPA/chatbots and workflow platforms; map to NIST CSF ISO 27001/27002 CIS Controls OWASP and internal policy; measure and uplift control coverage and maturity over time.
• Risk Assessment and Treatment: Lead highimpact assessments for S/4HANA migration engineering service changes new automation deployments platform integrations AI/ML and agentic automation and M&A due diligence; ensure risks exceptions and treatments are consistently documented and tied to business outcomes.
• Remediation Program Leadership: Sponsor and lead all aspects of multiteam programs addressing vulnerabilities configurations architectural gaps and control deficiencies. Identify turning points RAID progress tracking and benefits realization to ensure lasting risk reduction.
• Remediation Execution and Orchestration: Drive delivery across SAP Basis teams software engineering leads automation centers of excellence and platform owners; handle dependencies remove blockers and coordinate timing with release schedules and SOX change-control requirements to protect stability and compliance.
• Control Assurance and Audit Readiness: Oversee control health testing and evidence management; lead engagements with internal/external auditors and regulators across ISO 27001 SOC 2 SOX ITGC (for SAP financial systems and SDLC controls) and GxP/GMP where applicable; ensure durable traceable auditready evidence.
• ThirdParty and Software Supply Chain Risk: Set supplier and SaaS risk standardsincluding due diligence minimum controls contractual clauses SCA and continuous monitoringfor systems integrators platform vendors thirdparty apps and opensource libraries; integrate thirdparty risk into the register and own executive blocking issues.
• Data AI and Privacy Enablement: Safeguard critical and regulated data across SAP automation workflows and platform integrations; enable compliant AI/ML and agentic automation via classification encryption DLP monitoring and modelrisk controls aligned to GDPR NIS2 and internal data governance standards.
• Incident Preparedness and Response Leadership: Partner with security operations and crisis teams to strengthen playbooks and BCP for SAP automation platform and supply chain scenarios; sponsor corrective actions and ensure lessons learned to become durable control improvements.
• Metrics Reporting and Executive Communication: Define benchmarks/KRIs and businesscentric dashboard privileged bot access posture platform configuration scores repeatfinding rates mean time to remediateand communicate posture and priorities to executive governance and when required Boardlevel forums.
• Collaborator Management: Build trusted relationships across platform engineering architecture quality legal/privacy audit sourcing and cyber leadership; influence investment to resolve systemic risks and remove multi-functional blockers

• 15 years of dynamic experience in information security including 8 years leading risk management remediation BISO or equivalent functions and influencing senior business and IT executives at VP/SVP level.
• Demonstrated track record of crafting and operating an enterprise risk lifecycle (identification assessment treatment acceptance monitoring) and remediation portfolio in sophisticated global organizations and measuring risk reduction and control development throughout the duration across enterprise application and software delivery environments.
• Demonstrated ability to apply LLMs and agentic automation to improve cybersecurity and business outcomes translating use cases into measurable gains (e.g. faster risk triage automated control evidence collection improved detection and response accelerated software vulnerability triage) while protecting critical data and maintaining appropriate oversight of automated processes.
• Deep experience implementing and operationalizing controls defined by NIST CSF ISO 27001/27002 CIS Controls OWASP (ASVS Top 10 SAMM) and related frameworks across enterprise applications software delivery pipelines and SaaS platforms demonstrating measurable maturity improvement at enterprise scale.
• Good understanding of SAP security architecture including authorization concepts (role design SoD analysis and remediation GRC or equivalent experience) Basis and system security (transport management RFC/interface security secure landscapes) S/4HANA and cloud security considerations and SOX ITGC controls for SAP financial systems; ability to assess risk lead remediation and partner with Basis and GRC teams.
• Handson leadership embedding security into SDLC and delivery pipelinesSAST DAST SCA secrets management container/Kubernetes security CI/CD hardening software composition analysis and opensource risk management and developer enablementwith evidence of measurable risk reduction at scale.
• Understanding of risks in RPA/chatbot deployments including privileged credential management for attended/unattended bots bot lifecycle governance sensitive data handling emerging agentic AI security and integration security; ability to define enterprise bot security standards and drive remediation.
• Experience securing enterprise workflow platforms access and role governance integration/API authentication service account and privileged access management thirdparty app/plugin risk workflow/scoped app security and audit trails and handling risk across broad enterprise integrations.
• Demonstrable ability to handle challenging executive priorities. Deliver results under time constraints related to release windows audit cycles delivery achievements automation golives and regulatory commitments. This occurs across a highly matrixed global environment.
• Bachelors degree or equivalent experience in Information Security Computer Science Risk Management or related field (masters degree or equivalent experience strongly preferred).
• Professional certifications such as CISSP CISM or CRISC required.

• Experience working in a global matrixed organization with distributed teams and significant operations across the US UK Sweden China Japan India and Latin America.
• Direct experience as a BISO Head of Cyber Risk or Head of Application Security in a regulated pharmaceutical life sciences or comparable organization with substantial SAP and software engineering responsibility.
• Handson experience with SAP GRC authorization design analysis and Basis security in a SOXcompliant environment.
• Direct experience leading largescale application security programs
• Experience securing enterprisescale RPA and automation

When we put unexpected teams in the same room we unleash aggressive thinking with the power to inspire life-changing -person working gives us the platform we need to connect work at pace and challenge perceptions. Thats why we work on average a minimum of three days per week from the office. But that doesnt mean were not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.

Join a technology community that connects the dots across the enterprise to simplify scale and unlock real business value. You will work at the heart of significant shifts next-generation engineering pipelines and intelligent automation. Unexpected teams capture together in a shared space to challenge assumptions and fuel aggressive thinking. We value grit alongside ambition and back crucial leaders with data teamwork and modern tooling. Your expertise will help shape secure platforms that power our science and operations so medicines reach patients optimally. This is a place to move fast to learn continuously and to see your impact measured in both risk reduction and business outcomes.

Lead measurable risk reduction at enterprise scale and build the secure foundation for breakthrough sciencetake the next step and make your impact now!

Date Posted

Closing Date

AstraZeneca embraces diversity and equality of opportunity. We are committed to building an inclusive and diverse team representing all backgrounds with as wide a range of perspectives as possible and harnessing industry-leading skills. We believe that the more inclusive we are the better our work will be. We welcome and consider applications to join our team from all qualified candidates regardless of their characteristics. We comply with all applicable laws and regulations on non-discrimination in employment (and recruitment) as well as work authorization and employment eligibility verification requirements.