Device management support specialist

• Provide governance/risk advice and support for Global Functions (supporting business functions in Novartis such as Finance, P&O, Legal and Compliance etc) and oversee a specific governance/risk area globally. Ensure IT project risks are managed in line with ISRM strategy, the policy framework, laws and regulations and outstanding industry standards.


• Ensure monitoring of information risk and proactive mitigation of issues. Deliver global information governance programs, e.g. risk management processes, information security awareness programs, data classification, storage & transmission guidelines, audit support, or development and maintenance and implementation of the Information Management Policy Framework


• Maintain strong knowledge of internal controls and internal risk and control frameworks/standards or the Information Management Policy Framework


• Having in depth knowledge of SOX Audit and SOX controls execution. Experience in managing SOX compliance audits working with both internal/external auditors and application managers.


• Ensure Novartis information assets (including Crown Jewels) are adequately and appropriately secured by working with security SMEs in deploying appropriate security measures; and identified vulnerabilities are analyzed, prioritized, and treated for in-scope applications in operations


• Ensure good communication and collaboration with the Service Delivery Teams, advise them on information security, IT compliance and / or information risk management matters. Ensure role, accountability, and responsibility of ISRM is known and understood. Vice versa, establish clear accountability of the "first layer of defence" with IT and business, such that security and IT compliance accountability is not abdicated to ISRM (which should have a "2nd layer of defence" role)


• Continuously support risk-based treatment of threats, gaps, vulnerabilities, and risks in the Service Delivery area. Support dashboards, reports and KPI reporting and improvements. Guide teams and support them in understanding the risk exposure and technical safeguards.


• Identify points of improvement or gaps in the service delivery of the central ISRM teams and work together with them to resolve them. Review ongoing improvements and the feasibility of enhancements to global processes for ISRM.


• Systematically support implementation and monitoring of the ISRM Policy Framework on Information Technology and Operational Technology projects within the IT Function


• Analyse impact of new technologies and regulatory changes on information security considering Cyber Security and Data Privacy Acts, Laws, and Regulations


• Additional Accountabilities:


• Identifies points of improvement or gaps in the service delivery of the central ISRM teams (Compliance Services) and collaborate with central ISRM Compliance Services to resolve them.


• Deep understanding in SAP Security and how it works directly relates to compliance and regulatory audit requirements


• Understanding SAP Security roles, profiles, and user access controls for SAP instances


• Knowledge of GRC solutions, Identity Governance and Assurance solutions e.g. SAP GRC and SAP Cloud Identity and Access governance


• Familiar with SAP ECC, BW, HANA and Cloud environment

• University level degree in business/IT technical/scientific area or comparable education/experience


• 5+ years of professional experience in a similar role, 10+ years of working experience in IT


• Good knowledge with GxP regulated business processes in the pharmaceutical industry, preferably QC&QA, Supply Chain and/or Manufacturing & Engineering.


• Experience with supporting projects about Information Security and Risk Management topics for high complexity multi-site, regional, global project portfolio / scope. Experience in an international matrix organization


• Strong knowledge in IMF Framework and ISRM Tools. Understand and be able to efficiently support Waterfall SDLC and Agile ways of working. Understand and effectively support project delivery.


• Experience in reporting to and communicating with senior management (with and without IT background, with and without in-depth risk management background) on information risk topics. Experience in practical application of Risk Management


• Proficient in English (written and spoken)

Desirable:

• Experience with IT security and implementing policies in manufacturing setup


• Professional information security, risk or audit certification, such as CISSP, CISM, CIA, CISA, CRISC or ISO 27001 auditor / practitioner