Senior Director - Design Assurance, Product Management

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centered on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.
Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: Function head for cyber security product management and Design Assurance across the Cyber Architecture and Solutions portfolio.

Job Purpose:

Serve as the quality, governance and product authority for Cyber Architecture & Solutions. You are accountable for ensuring every security solution Cyber Architecture and Solutions designs and builds meets the required quality, compliance and operational standard before it reaches the global managed service vendor — the independent quality gate between what Cyber Architecture and Solutions produces and what the vendor is asked to operate. You own the Cyber Architecture and Solutions governance framework, the security product portfolio, vendor governance for the managed service as a whole, and the programme capability that delivers all Cyber Architecture and Solutions change. Platform support engineering moves into this function, with a small internal team retaining accountability while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles, and the primary Cyber Architecture and Solutions interface to internal audit, regulators and the second and third lines of defence.

About the team:

Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.

What makes this role different. The defining tension is that you assure against standards you do not own. Architecture writes them; you verify independently and make binding pass-or-fail calls on vendor handover readiness — and that separation has to survive pressure from programmes with deadlines and from architects who will not welcome the finding. You are also the executive accountable for a vendor operating more than 30 platforms, where the operational risk is real but the levers are contractual rather than direct. Expect audit and regulatory scrutiny of the governance framework you own, and be ready to evidence a governance function of yours that withstood it.

Key responsibilities:

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Define, own and continuously improve the Cyber Architecture and Solutions governance and quality framework — the assurance process, the pass or fail criteria for vendor handover and the exception regime — applying the design standards owned by the Architecture function rather than authoring them.

• Own and operate the independent design assurance process, making binding pass or fail determinations on vendor handover readiness with no compromise on quality.

• Lead a 17-role function spanning Design Assurance, Security Product Management, and vendor and portfolio governance, sustaining a culture of rigour, independence and delivery.

• Own the Cyber Architecture and Solutions security product portfolio: product roadmaps for every capability under Cyber Architecture and Solutions's remit, full lifecycle management from introduction through evolution to decommission, prioritised against GSK's cyber risk appetite.

• Hold ultimate commercial accountability for vendor governance across the managed service — performance, SLA, escalation and commercial levers, and oversight of platform support as it transitions to the OTO model — with day-to-day governance delegated to the Associate Director for vendor governance.

• Own Cyber Architecture and Solutions security risk and exception management at the most senior level: assess complex architectural risk exceptions, maintain the Cyber Architecture and Solutions risk register, and escalate material unmitigated risk with unambiguous clarity.

• Own Cyber Architecture and Solutions-wide metrics and security posture reporting, and present authoritative performance evidence to the CISO, ExCo and Board-level risk committees.

• Lead Cyber Architecture and Solutions engagement with internal audit, external regulators and the second and third lines of defence, evidencing design quality and governance effectiveness.

• Own portfolio intelligence and investment analytics so prioritisation decisions are evidence-based rather than loudest-voice.

• Protect the independence of assurance when it is commercially or politically inconvenient.

• Own the function's budget and the security tooling spend envelope it governs, and defend the consolidation savings committed in the annual plan against the renewal calendar.

• Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK's Responsible AI, privacy and security requirements.

• Set the technology and opportunity investment agenda for the portfolio — what to adopt, what to pilot and what to retire, including AI-enabled capability — and hold the evidence that justifies each decision.

Basic Qualifications:

• 20+ years in cyber security, including 7+ in senior leadership in a regulated environment leading leaders across geographies — domain focus: function head for cyber security product management and Design Assurance across the Cyber Architecture and Solutions portfolio

• End-to-end product management of cyber security products — threat-led use-case definition, business case and investment, roadmap, vendor evaluation and selection, onboarding, adoption and value tracking, renewal and decommission — running capabilities as products with outcome KPIs (coverage, adoption, efficacy, cost per capability)

• Building and leading a cyber security product management practice with domain product owners for each domain group, each mirrored to a Security Solution Engineering squad working in parallel, and technical deep dives proving product efficacy and integration

• Leading an independent Design Assurance practice and governing a security managed service — binding pass or fail decisions on handover readiness made against standards owned by the Architecture function and never by you, supported by drift detection, QBRs and EBCs.

• Leading AI adoption across the portfolio and assurance — AI-enabled tool evaluation, assurance of agentic solutions and AI-driven lifecycle automation from intake to decommission

Preferred Qualifications:

• Architecture literacy to make binding quality judgements on expert architecture output they do not own, expressed as non-conformance to a specific standard clause

• Delivering enterprise security tool rationalisation with quantified savings, sequenced against renewal dates, with automated utilisation and renewal analytics

• Evidencing design and product governance to internal audit, external audit and regulators, producing decisions, approvals and exceptions on demand

• Credibility with Board-level risk committees, presenting assurance outcomes, portfolio performance and residual risk directly

• Commercial acumen — multi-year vendor contracts, TCO and cost-to-serve modelling
• Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.
• Typical tools and technologies: Product portfolio and roadmap platforms, vendor performance, SLA and commercial governance, design assurance methodology and assurance register, AI-assisted and agentic lifecycle automation, ServiceNow, Power BI for portfolio and assurance analytics, GxP-compliant documentation and audit evidence management.
  

#AGTech

Skills

AI for Cybersecurity, Application Security, Cloud Security, Computer Programming, Cybersecurity, Data Security, Design Assurance, Global Team Management, Identity Access Management (IAM), Information Systems, Infrastructure Security, ML Security, Network Security Design, Operating Systems Security, Product Management, Product Portfolios, Scripting, Security Engineering, Security Strategy Transformation, Security Technologies, Security Testing, Vulnerability Management

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at [email protected] to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing [email protected], so that we can confirm to you if the job is genuine.