GRC Compliance Senior Analyst
Novartis
Summary
The GRC Compliance Senior Analyst supports information security, risk, and compliance activities across business applications, IT/OT services, and manufacturing sites. The role ensures solutions are designed, developed, and operated in accordance with organizational security standards, regulatory requirements, and governance frameworks, and drives continuous improvement of security compliance programs, risk management practices, and audit/inspection readiness.
Job description
Key Responsibilities
- Provide ISC governance/risk advice and support for Operations IT and OT Function and oversee a specific governance/risk area globally.
- Ensure IT/OT project risks are managed in line with ISC strategy, the policy framework, laws and regulations and industry standards.
- Ensure monitoring of information risk and proactive mitigation of issues.
- Continuous support risk-based treatment of threats, issues and vulnerabilities.
- Guide teams and support them in understanding the risk exposure and technical safeguards.
- Deliver global information governance programs like risk management, data classification, storage & transmission guidelines, audit readiness support, etc.
- Maintain strong knowledge of internal controls and internal risk and control frameworks/standards or the Information Management Policy Framework.
- Systematically support implementation and monitoring of the same.
- Provide KPI reporting, dashboards, and continuous improvements to ensure compliance.
- Analyse impact of new technologies and regulatory changes on information security considering Cyber Security and Data Privacy Acts, Laws, and Regulations.
- Ensure good communication and collaboration with the Service Delivery Teams of the DDIT operations and other support partners.
- Share new ideas, be proactive and have desire to deliver business value.
- Leverage AI and automation to streamline compliance activities, including risk assessments, control documentation, testing, issue management, and audit support.
Essential Requirements
- Over 8+ years of experience in Business Information Security and Compliance, IT Risk management, Audit management, Information Governance and Management, GRC.
- University degree in business/technical/scientific area or comparable education/experience.
- Extensive knowledge and experience to efficiently manage risks, vulnerabilities and Issues within the function.
- Disciplined approach in managing the functional & operational risks, successful engagement with stakeholders, advocacy to drive Information Security Compliance activities.
- Demonstrated ability to collaborate effectively and build successful partnerships with key stakeholders, vendors, support teams, and internal cross-functional teams.
- Experience with Good Practice Quality guidelines and regulations (GxP).
- Strong stakeholder management skills (Senior Business Execs, IT Site Heads, etc.).
- Excellent communication skills with proficiency in English (written and spoken).
Desirable Requirements
- Experience with OT security compliance and implementing policies in manufacturing setup, ideally in pharma.
- AI knowledge and experience.
- A professional Information Security certifications, either from ISACA like CISM, CRISC, CISA and/or ISC2 like CISSP, CCSP, etc.
Requirements
- Over 8+ years of experience in Business Information Security and Compliance, IT Risk management, Audit management, Information Governance and Management, GRC
- University degree in business/technical/scientific area or comparable education/experience
- Extensive knowledge and experience to efficiently manage risks, vulnerabilities and Issues within the function
- Disciplined approach in managing the functional & operational risks, successful engagement with stakeholders, advocacy to drive Information Security Compliance activities
- Demonstrated ability to collaborate effectively and build successful partnerships with key stakeholders, vendors, support teams, and internal cross-functional teams
- Experience with Good Practice Quality guidelines and regulations (GxP)
- Strong stakeholder management skills (Senior Business Execs, IT Site Heads, etc.)
- Excellent communication skills with proficiency in English (written and spoken)
- Experience with OT security compliance and implementing policies in manufacturing setup, ideally in pharma
- AI knowledge and experience
- A professional Information Security certifications, either from ISACA like CISM, CRISC, CISA and/or ISC2 like CISSP, CCSP, etc.
Benefits
- Health insurance
- Life insurance
- Disability benefits
- 401(k) with company contribution and match
- Paid time off
- Vacation
- Personal days
- Holidays
- Performance-based cash incentive
- Annual equity awards
Company overview
Novartis is a global pharmaceutical company headquartered in Basel, Switzerland, dedicated to reimagining medicine to improve and extend people's lives. As an innovative medicines company, Novartis focuses on developing high-value treatments that address society's greatest disease burdens through technology leadership in research and development. The company operates across five core therapeutic areas: cardiovascular, renal and metabolic diseases; immunology; neuroscience; oncology; and hematology. With a workforce of approximately 75,883 employees worldwide, Novartis reaches nearly 300 million patients across 118 countries. The company leverages advanced technology platforms including targeted protein degradation, cell therapy, gene therapy, radioligand therapy, and xRNA to develop breakthrough treatments. Novartis maintains a strong portfolio of oncology drugs and generics while continuously expanding its pipeline through strategic acquisitions and internal research. The company's commitment extends beyond drug development to ensuring global access to medical innovations through novel access approaches and patient assistance programs.