Cyber Security Compliance Manager

Site Name: Bengaluru Luxor North Tower Posted Date: Jul 21 2022 Is there any greater challenge than getting ahead of disease? At GSK, we have already delivered unprecedented change over the past four years, improving R&D, becoming a leader in Consumer Healthcare, strengthening our leadership, and transforming our commercial execution. Now, we’re making the most significant changes we’ve made to our business in over 20 years. We’re on track to separate and create two new companies in 2022: New GSK with a leading portfolio of vaccines and specialty medicines as well as R&D based on immune system and genetics science; and a new world-leading consumer healthcare company of loved and trusted brands. With new ambition comes new purpose. For New GSK, this is to unite science, talent, and technology to get ahead of disease together – all with the clear ambition of delivering human health impact; stronger and more sustainable shareholder returns; and as a new GSK where outstanding people thrive. Getting ahead means preventing disease as well as treating it. How we do all this is through our people and our culture. A culture that is ambitious for patients – so we deliver what matters better and faster; accountable for impact – with clear ownership of goals and support to succeed; and where we do the right thing. So, if you’re ready to improve the lives of billions, join us at this exciting moment in our journey. Join our challenge to get Ahead Together. Job Purpose:- GSK’s Vulnerability Management services assist our business units in aligning security management strategy with business goals by identifying, prioritizing and managing the vulnerabilities in a timely fashion The Cyber Risk & Assurance- VM Senior Manager will work within GSK’s Cyber Risk & Assurance team, interacting directly with stakeholders and technical teams to drive and support the Vulnerability Management program. This includes managing and supporting activities that are focused on improving overall Vulnerability Management program and managing the entire Vulnerability Management risk posture, in turn improving the delivery of the solutions. Cyber Risk & Assurance- VM Senior Manager will work in conjunction with a wider security assurance function and will be expected to take on responsibilities outside of core threat and vulnerability management, and as such will require broad Information Security skills on top of threat and vulnerability management experience. Key Responsibilities:- Responsible for the development of a new threat and vulnerability capability by setting best practice, as well as determining process and controls. Further responsibilities will include working with IT teams in order to reduce vulnerabilities, as well as spotting trends and patterns across the threat landscape. Managing, coordinating or consulting on development and execution of one or more information security capabilities and/or controls. Research emerging information security threats, changes in regulatory landscape, and/or industry standards. Communicating findings to Senior Leadership. Providing leadership and direction within the area of responsibility. Assisting in the development of information security policies, procedures, guidelines, standards and key performance indicators within area of responsibility. Providing information to the leaders/company regarding the operations and effectiveness of the information security program within area of responsibility. Working on issues where analysis of situations or data requires an in-depth knowledge of area of responsibilities. Providing guidance to junior members of team/function. Developing and coordinate the Vulnerability Management services with the context of cyber risk Developing strategy of continuous identification of vulnerabilities in GSK systems and applications, including inhouse and third part provided infrastructure scans, web application scans, mobile application, source code scanning and penetration tests Cooperation with internal and external stakeholders to lead global Vulnerability Management processes Propose and implement improvements to the landscape of technical security safeguards, including technologies, systems and associated processes and procedures Developing and executing strategies and roadmaps to provide GSK with need-based, value-adding, and cost-effective Cyber risk solutions Developing assessment frameworks, methodologies to identify and remediate risks Analysing GSK’s cyber security infrastructures to enable targeted and data-driven enhancements Ensuring that GSK’s business needs are met when developing assessment frameworks to ensure effective, targeted, and actionable analyses Applying multiple security testing methodologies and techniques to assess GSK’s security infrastructures and identify / evaluate vulnerabilities Gathering data and determines priority criteria to build an integrated roadmap that addresses all facets of a Cyber Assessment or implementation Assessing cyber security policies and procedures to analyse compliance with regulatory requirements and evaluate overall operational efficiency; provides GSK business owners with mitigating solutions Proficient with multiple domain-specific cyber security technology solutions and can effectively integrate them to meet and exceed GSK’s requirements Enabling sustainability and continuous improvement of cyber security solutions by assessing and enhancing GSK’s cyber security governance infrastructures Understanding and applying cyber threat intelligence and profiling to the design and assessment of GSK’s systems Testing the effectiveness of GSK’s cyber security technologies to identify and articulate opportunities for improvement across the digital, physical, and social elements of GSK Conducting complex business process assessments to help GSK identify, analyse, and prioritize gaps and risks; applies findings to make recommended upgrades aligned to the overall strategy Developing effective and sustainable technology/tools and Cyber risk management strategies by tailoring leading Cyber frameworks on GSK’s business and technology needs Understanding the interaction of business and technology processes / risks and can explain it in business terms to both technical and non-technical audiences Evaluating and recommend emerging security products that enable and optimise Vulnerability Management Understanding and be able to operate successfully in the context of IT processes for configuration, change and release management. Working very closely with product managers, architects/developers and business application owners to define technical product requirements and collaborate within team to drive user story/tasks creation along with design, development and security testing activities. Building automation in control testing to ensure effectiveness of control testing Basic Qualifications:- Bachelor's Degree with related experience leading information security technology, project management, and/or strategy. Proven working knowledge of the National Institute of Standards and Technology (NIST) guidelines described in NIST SP 800-40 for Enterprise Patch Management Proven working knowledge of the SANS guidelines on Threat and Vulnerability Assessment and Managing Security Vulnerabilities Knowledge of various vulnerability management tools, technologies and processes A technical understanding of vulnerability and malware analysis and the ability to assess risk Understanding of event management solutions, and automation and orchestration platforms Ability to communicate the evolving threats and trends and report on KPIs and KRIs to Cyber leadership Knowledge of how patch management takes place within organisation and how to support IT teams in ensuring systems are adequately patched Experience in process definition, workflow design, and process mapping Preferred qualifications:- Advanced certifications, diplomas, professional certifications, advanced degrees in Cyber or information security - examples include: CISSP, CISM, CISA, CIPT, CIPM, CRISC or other relevant certification desired Microsoft certified Solutions Architect. ITIL (IT Infrastructure Library) At GSK we value diversity (Gender, LGBTQ +, PwD etc.) and treat all candidates equally. We aim to create an inclusive workplace where all employees feel engaged, supportive of one another, and know their work makes an important contribution. *LI-GSK Our goal is to be one of the world’s most innovative, best performing and trusted healthcare companies. We believe that we all bring something unique to GSK and when we combine our knowledge, experiences and styles together, the impact is incredible. Come join our adventure at GSK where you will be inspired to do your best work for our patients and consumers. A place where you can be you, feel good and keep growing. Important notice to Employment businesses/ Agencies GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site. It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way. GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKilne (or GSK) group company at any worldwide location. Even if they claim that the money is refundable. If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing [email protected], so that we can confirm to you if the job is genuine.