GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch current, groundbreaking treatments that address critical health challenges.

The Director, Risk Detection & Response leads and operationally runs the Risk Detection & Response function within GSK's Risk Operations Centre, directing a multi-disciplinary team that identifies and evaluates technology risk across GSK's business systems and infrastructure, sites, suppliers and people. The role gathers data on assets and threats, and assesses control design and operating effectiveness in that context. It also manages the end-user policy exceptions and workstation software risk assessment processes. Risk Detection and Response is part of GSK's Risk Operations Centre. The team gathers data and evidence across GSK's systems, sites, suppliers and people to assess whether controls are well-designed and operating effectively, manages third-party cyber risk, end-user policy exceptions and workstation software risk, and runs Internal Controls Assurance, GSK's own self-auditing service over the effectiveness of governance and control processes.

Own end-to-end delivery of systemic on-going and ad hoc risk assessment across GSK's systems, sites, suppliers and people, including technical evaluation of control effectiveness and scoring of risk against the enterprise risk management rubric for impact and likelihood.

Direct the team's assurance activity over control design attestations and evidence submitted by Digital & Tech product teams as they navigate the SDLC and compliance requirements.

Own the Third-Party Cyber Risk Management programme, including upfront and periodic supplier risk assessments, governance of cyber contractual schedules, procurement redline support and mitigating control recommendations.

Lead Internal Controls Assurance, the team's self-auditing service providing independent assurance over the effectiveness of GRC processes.

Direct the build-out of capability to monitor the operating effectiveness of controls for applications and systems, and site-level Operational Technology controls across Supply Chain (manufacturing,



logistics, quality labs) and R&D; labs.

Own the security assessment process for desktop software published to the end-user software portal, and the end-user policy exceptions process (e.g. USB blocking, web filtering, local admin).

Manage, develop and resource-plan the team across its Systems Risk, Supplier Risk and Site/OT Risk pillars, including sourcing and directing vendor augmentation for project surges.

Set, monitor and report KPIs on the effectiveness and efficiency of Risk Detection & Response processes, applying Lean Six Sigma methods to drive continuous, measurable improvement.

Act as the escalation point for the function with Cyber Security Office and GRC stakeholders globally, representing Risk Detection & Response in cross-functional risk governance forums.

Degree in cybersecurity, information risk/technology or a related discipline, or related experience.

Demonstrated experience in operational risk assessment, control assurance or technology risk management.

Practical experience with third-party and supplier cyber risk management.

Substantial experience in cyber security, including standing up and operationally running a multi-disciplinary function.

Proven experience managing and developing a team of managers and analysts, including vendor and contractor augmentation.

Experience applying Lean Six Sigma or other process excellence methods to build a KPI-driven, continuously improving operation.

Experience with Internal Controls Assurance or internal audit-style self-assurance functions.

Working knowledge of the software development lifecycle (SDLC) and software development compliance requirements.

Familiarity with Operational Technology (OT) environments, including manufacturing, logistics, quality labs and R&D; labs.

Experience sponsoring or building AI agents or intelligent automation for risk and compliance operations.

Experience in a regulated industry with change control constraints.

Experience in pharmaceutical, life sciences or another highly regulated industry.

GRC platforms, ServiceNow, Power BI, risk assessment and control assurance tooling, AI/intelligent automation tooling.

#Cloud Security, Controls Assurance, Control Strategy, Cybersecurity, Data Integrity, Design Controls, Executive Reports, Identity Access Management (IAM),



Risk Assessments, Risk Management, Risk Management Assessment, Risk Management Framework, Security Architecture Design, Security Compliance, Security Policies, Security Risk, Technology Risk Management, Third Party Risk Management, Vulnerability Management, Web Application Security

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in 'gsk.

📌 Head of Internal Audit and Risk (Bengaluru)
🏢 GSK
📍 Bengaluru