Director, Information Security Governance, Risk, Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Design and uphold enterprise cybersecurity governance, risk, and compliance strategies that align with organizational goals and regulatory standards.

• Oversee enterprise risk assessments, compliance evaluations, and control maturity analyses across business and technology sectors.

• Spearhead the creation and execution of cybersecurity policies, standards, procedures, and governance frameworks.

• Provide strategic guidance for audit readiness activities that support internal audits, regulatory reviews, and assessments by third parties.

• Assess and convey the enterprise's cyber risk posture, key risk indicators, and remediation priorities to executive leadership and governance committees.

• Manage third-party cybersecurity risk management processes, which include supplier risk assessments and contractual security stipulations.

• Coordinate organization-wide remediation strategies for vulnerabilities, audit findings, and risk treatment plans.

• Direct strategic planning and budgeting processes for cybersecurity governance and compliance initiatives.

• Collaborate with legal, privacy, quality, manufacturing, and IT leadership to ensure cybersecurity governance is consistent with enterprise risk management goals.

• Assist in developing business continuity and operational resilience strategies for essential business functions.

• Work alongside architecture and engineering teams to guarantee that security controls and compliance requirements are incorporated into technology solutions.

• Foster cybersecurity awareness and promote risk-informed decision-making across business units and leadership teams.

• Support organizational efforts related to mergers, acquisitions, and digital transformation by assessing cybersecurity and compliance risks.

⛳️ Requirements

• A minimum of a Bachelor’s degree in MIS, IT, Engineering, or a related field is required.

• Equivalent experience and/or education may be taken into account.

• At least eight years of experience in IT or Cybersecurity is necessary.

• Familiarity with cybersecurity and privacy principles, frameworks, and regulatory requirements relevant to global pharmaceutical companies.

• Understanding of enterprise risk management methodologies, governance structures, and compliance assessment techniques.

• Knowledge of audit practices, internal controls, and regulatory compliance requirements including SOX, HIPAA, GDPR, and GxP standards.

• Awareness of third-party risk management concepts and vendor governance processes.

• Proficiency in incident management, vulnerability management, and security operations governance.

• Understanding of security architecture concepts, cloud technologies, and data protection strategies.

🏝️ Benefits

• Competitive salaries

• Comprehensive benefits

• An inclusive work environment

• Commitment to equal opportunity employment