BISO - Manufacturing, Operations & Enabling

Are you ready to safeguard the digital backbone that keeps medicines moving from development to patients? This is your opportunity to be AstraZeneca’s primary strategic cybersecurity partner across two critical portfolios—regulated manufacturing environments and enterprise business applications—where every security decision helps protect product quality, patient safety, financial integrity, and business continuity. In this customer-facing role, you will represent the CISO and lead engagement, alignment, and delivery of cybersecurity risk and resilience outcomes. You will guide security priorities and long-term posture across operational technology and manufacturing execution systems, as well as enterprise SaaS platforms such as Workday, SAP, Coupa, and Concur. Can you balance the realities of 24/7 production with the pace of cloud/SaaS innovation to achieve measurable, inspection-ready results? Accountabilities Dual-Portfolio Strategic Partnership: Serve as the lead security partner to Manufacturing Operations IT and Enabling Units IT leadership, shaping governance forums to drive risk-based decisions, clear accountability, and visible security outcomes across both portfolios. Risk Posture and Architecture: Guide architects to define layered security approaches suited to each environment—industrial security architecture for plants and cloud-native controls for enterprise SaaS—so that controls are effective, pragmatic, and scalable. Manufacturing Technology Security: Lead security for operational technology, industrial control systems, and manufacturing execution systems, implementing segmentation, secure remote access, and privileged access practices that respect validation and uptime requirements. Enterprise SaaS and Cloud Security: Drive security consulting and risk management for Workday, SAP, Coupa, Concur and other enterprise platforms, covering identity and access management, data protection, integration security, privileged access governance, and vendor assurance. Regulatory and Compliance Alignment: Embed controls aligned to GMP/GxP and computerized system validation in manufacturing, financial controls and SOX for Finance, GDPR for employee data, and due diligence requirements for Legal and M&A—demonstrating audit- and inspection-ready evidence. Validation-Aware and Change-Controlled Delivery: Ensure security improvements align to validation and change control processes, with impact assessments, documentation, and compensating controls that maintain production continuity and business operations. Asset Visibility and Vulnerability Management: Establish comprehensive inventories and risk-based vulnerability management across both manufacturing technology and SaaS/cloud platforms, reducing critical exposures while respecting patching and update constraints. Integration and Data Flow Security: Secure data flows from shop-floor to enterprise and across business applications (HR-to-Finance, procurement-to-payment), with strong identity controls, logging, monitoring, and resilience patterns. Third-Party and Vendor Risk Management: Strengthen supplier risk management for automation vendors, equipment manufacturers, SaaS providers, cloud platforms, and business service partners through enforceable minimum controls, ongoing assurance, and secure support models. Incident Preparedness, Response, and Recovery: Collaborate with security operations and business teams to create environment-specific playbooks, run tabletop exercises, and improve recovery readiness for production-critical and business-critical services. Inspection and Audit Readiness: Maintain evidence aligned to GMP expectations and audit requirements for financial controls, SOX, data privacy, and M&A due diligence to ensure continual readiness. Metrics and Continuous Improvement: Build risk dashboards and KPIs spanning both portfolios—segmentation coverage, remote access compliance, critical exposure reduction, SaaS posture, identity governance maturity, recovery readiness—and drive measurable improvement over time. Culture, Awareness, and Operating Model: Tailor cybersecurity culture and training for operations/engineering/site roles and for Finance, HR, Legal, GBS, and M&A users, enabling role-appropriate security practices and shared ownership of risk. Lead and Coach a High-Performing Team: Set clear goals tied to risk reduction and resilience, coach for performance, and create an environment where consultants and analysts thrive and deliver tangible outcomes. Essential Skills/Experience 10+ years of experience in information security positions, with 5+ years' experience overseeing an information security function and influencing senior business/IT stakeholders across diverse technology environments Demonstrated experience securing both manufacturing/operational technology environments and enterprise business applications, with ability to translate operational and business realities into effective cybersecurity controls - Strong familiarity with multiple regulatory and compliance frameworks including GMP/GxP and computerized system validation (pharmaceutical manufacturing), financial controls and SOX compliance (Finance), data privacy regulations (GDPR), and electronic records/signatures regulations - Proven ability to design and operationalize security controls appropriate to diverse environments—industrial security architecture for manufacturing systems and cloud-native security patterns for enterprise SaaS platforms - Hands-on experience securing manufacturing technology systems (operational technology, industrial control systems, manufacturing execution systems) including segmentation, secure remote access, and controls appropriate for high-availability production environments - Hands-on experience securing enterprise SaaS and cloud platforms, including identity and access management, data protection, integration security, and vendor risk management for major enterprise applications (experience with Workday, SAP, or similar platforms highly desirable) - Security standards and frameworks: Working knowledge of relevant industrial control system security standards (ISA/IEC 62443, NIST SP 800-82) and enterprise security frameworks (NIST CSF, ISO 27001/27002, CIS Controls), with ability to apply appropriate controls to each environment - Experience running risk-based vulnerability management across diverse technology stacks—from manufacturing systems with patching constraints to enterprise SaaS platforms with continuous update models - Understanding of global incident response processes with experience adapting containment and recovery approaches to both manufacturing constraints (safety, quality, uptime) and business continuity requirements (financial close, payroll, procurement) - Experience managing cyber risk across diverse supplier types including equipment manufacturers, systems integrators, SaaS providers, cloud platforms, and business service providers, including enforceable minimum controls and ongoing assurance - M&A security experience: Familiarity with cybersecurity due diligence, integration security planning, and post-merger technology risk management is highly desirable - Demonstrat