Job highlights

- Qualifications: Bachelors degree in a relevant discipline,or equivalent skilled experience.
- You do not need to have built security controls,but you do need to read a MITRE ATTCK coverage map and judge for yourself whether two tools genuinely overlap or only appear to in the licence schedule
- Preferred Qualifications

Job Summary

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver 40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: Portfolio-wide analytics supporting all domain product owners.

Job Purpose

Own portfolio intelligence and investment analytics for Cyber Architecture and Solutions. You turn portfolio, vendor and delivery data into the evidence prioritisation and investment decisions are made from, and you are the analytical backbone of the function.

About the team

Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSKs security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.

What makes this role different

A genuinely analytical role, not a reporting role, and the distinction matters. Producing the pack is the easy part; the value is spotting the trend nobody asked about and bringing it to leadership unprompted. You do not need to have built security controls,



but you do need to read a MITRE ATTCK coverage map and judge for yourself whether two tools genuinely overlap or only appear to in the licence schedule. Your numbers will be used in investment decisions and challenged by people who do not want the answer, so they have to reconcile and you have to defend them.

Key responsibilities

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

- Own portfolio intelligence across the Cyber Architecture and Solutions product and project estate.
- Build and maintain the investment analytics that prioritisation decisions are made from.
- Produce portfolio reporting the leadership team steers by, and make the numbers defensible under challenge.
- Analyse vendor spend, performance and value across the managed service, including the OTO transition.
- Model investment scenarios and quantify trade-offs between competing priorities.
- Track benefit realisation against the cases that funded the work, including where benefits did not materialise.
- Own the data and definitions behind the reporting so figures reconcile across every forum.
- Identify trends and outliers and bring them to leadership attention unprompted.
- Build the costed option set for the annual plan, sequencing investment and decommission against the renewal calendar so consolidation savings are realised in the year they are claimed.
- Set the analytical standard for the function - data lineage, definition control and reproducibility - so any figure in a leadership pack can be traced to source and re-derived by someone else.
- Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSKs Responsible AI, privacy and security requirements.
- Apply data integrity and GxP record-keeping expectations to the figures this role publishes, so portfolio and benefit reporting stands up to audit.

Basic Qualifications

- 15+ years in cyber security or technology portfolio analytics in a regulated environment - domain focus: portfolio-wide analytics supporting all domain product owners




- Building a security portfolio intelligence capability at enterprise scale - threat-to-tool coverage matrix showing weak, duplicated or missing coverage, investment gaps and decommission candidates
- Automated portfolio monitoring - integrating tool inventory, licence and consumption, contract and renewal, cost and risk data into continuously refreshed dashboards, reconciling incomplete CMDB data
- Evidence-based decommission and consolidation business cases with quantified savings or risk reduction, analysed on the same domain structure as Security Solution Engineering
- Applying AI and machine learning to portfolio analytics - anomaly detection on licence and cost data, AI-assisted coverage mapping and assessment of AI-enabled security tools

Preferred Qualifications

- Power BI or equivalent, SQL and Python for portfolio analytics, automation and data engineering
- Security tool landscape knowledge across all security product domains, enough to judge whether two tools genuinely overlap
- MITRE ATTCK and NIST CSF applied to coverage mapping rather than cited in isolation
- Total cost of ownership, licence utilisation and shelf-ware analysis, including unused entitlement ahead of renewal
- Investment modelling and analytics support for domain product managers portfolio decisions
- Qualifications: Bachelors degree in a relevant discipline, or equivalent professional experience.
- Typical tools and technologies: Power BI or equivalent, SQL and Python for analytics and automation, data modelling across tool inventory, licence entitlement and consumption, contract and renewal dates and cost, threat-to-tool coverage mapping using MITRE ATTCK and NIST CSF, total cost of ownership and shelf-ware analysis, ServiceNow and CMDB data extraction, automated portfolio monitoring.

Skills

- AI for Cybersecurity
- Application Security
- Cloud Security
- Computer Programming
- Data Security
- DNS Server
- Domain Name System (DNS)
- Identity Access Management (IAM)
- Information Systems
- Infrastructure Security
- ML Security
- Network Theory
- Operating Systems Security
- Scripting
- Security Engineering
- Security Technologies
- Security Testing
- Software-Defined Networking Wide Area Network (SD-WAN)
- Vulnerability Management
- Zero Trust
- Zero Trust Architecture

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Senior Principal (Bengaluru)
🏢 GSK India
📍 Bengaluru