Executive Director, Global Cyber Governance, Risk, and Compliance; GRC

Introduction to role

Are you ready to set the global agenda for cyber governance and regulatory adherence within a firm where trusted, protected technology accelerates life-changing medicines to patients? Can you translate complexity into crucial action that protects trust while enabling ambitious innovation and speed?

As Executive Director for Global Cyber GRC, you will lead the enterprise approach to information security. You will coordinate technological risk and ensure our most critical data, platforms, and partners operate with resilience, regulatory confidence, and clear accountability. You will connect cyber risk to strategic decisions, equipping the company’s leadership team and Board with sharp, actionable insight that balances protection and progress.

This is a pivotal role in our transformation into a digital and data-led enterprise. You will guide the harmonization of controls throughout various regions. You will improve our response to evolving regulations. You will embed risk-informed decision-making into how we discover, develop, and deliver medicines worldwide.

• Lead the organization-wide information security and technology risk framework spanning all locations.
• Prioritize the most meaningful risks and drive treatment plans to closure.
• Lead all aspects of the worldwide cyber regulatory approach and ensure it meets laws, regulations, and standards. This includes confidentiality, information security, crucial infrastructure, and requirements outstanding to the life sciences sector across jurisdictions.
• Third-Party Risk Governance:
  Coordinate the management of cyber risk controls for vendors, academic collaborators, and technology service providers, safeguarding the extended ecosystem vital to global operations.
• Cyber Resilience Oversight:
  Provide governance for incident preparedness, crisis response coordination, and recovery preparation; ensure cohesive, end-to-end resilience outcomes with security operations, technology, legal, privacy and business continuity teams.
• Control Assurance and Ongoing Improvement:
  Ensure the build and efficiency of cybersecurity and information technology safeguards through continuous validation, evaluation, and detailed improvement.
• Build, lead, and advance international cyber risk oversight groups and senior risk advisory panels. Drive cross-functional decisions that align with the organization's risk tolerance and strategic goals.
• Communicate detailed engineering and compliance risk into clear choices for top leadership as well as the Board. Deliver concise, high-impact reports on posture, trends, and material exposures.
• Act as a reliable consultant to the heads of information security, information technology, risk and compliance functions, and legal partners. Represent the company in interactions with regulatory agencies, professional associations, and peer organizations.
• Distributed Team Leadership:
  Build, lead and develop a high-performing, distributed cyber GRC team with clear mission, measurable outcomes and strong succession.
• Business Enablement:
  Incorporate cyber risk within broader enterprise risk management to reduce friction, increase confidence and enable faster, safer delivery of scientific and commercial outcomes.

• Demonstrated experience establishing and leading an enterprise framework for managing cybersecurity and technological risk across multiple regions and business units.
• Proven ability to integrate cyber risk into enterprise risk management processes, aligned with corporate risk appetite and strategic objectives.
• Track record coordinating third-party cyber risk management across suppliers, research partners and technology vendors.
• Ownership of a global cyber regulatory strategy with compliance accountability across jurisdictions, including privacy, data protection, critical infrastructure and life sciences–specific requirements.
• Experience acting as the primary executive interface for cyber-related regulatory examinations, audits and inquiries.
• Evidence of harmonizing compliance controls across regions while maintaining local regulatory adherence.
• Governance oversight of cyber resilience programs,…