Associate Director - IAM Operations and Governance

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Job Purpose:

The Associate Director, IAM Operations and Governance will lead the team responsible for IAM audit controls and compliance governance across the identity estate. This hands-on role will set direction, translate strategy into an executable roadmap, assign clear ownership, remove delivery barriers and ensure commitments are completed to the required quality and timelines. The role will design and operate a modern, automated IAM control environment for SOX, GxP and other regulatory obligations, including continuous monitoring, evidence collection, control-to-evidence traceability, findings management and sustainable remediation. It will also lead the adoption of agentic AI and workflow automation to reduce manual effort, improve control effectiveness and provide audit-ready assurance.

About the team:

IAM Operations and Governance owns the control layer over GSK's identity estate: access certification, segregation of duties, identity risk reporting and the audit evidence that proves access is under control.

Key responsibilities:

This role will provide you the opportunity to lead key initiatives:   

• Lead the IAM controls, audit assurance and compliance governance capability, including its people, operating model, roadmap, delivery and outcomes; set clear priorities, delegate effectively and hold the team accountable for execution.

• Own the IAM control framework for SOX, GxP and other applicable regulatory and enterprise requirements, ensuring clear control objectives, ownership, frequency, procedures and accountability.

• Establish continuous controls monitoring across joiner, mover and leaver processes, access approvals, access certification, segregation of duties, privileged access, service accounts, orphaned accounts and excessive or stale access.

• Design and implement an automated control library that maps each control to its policy and regulatory requirement, systems in scope, control owner, required evidence, test procedure, exception criteria and remediation workflow.

• Apply Agentic AI and workflow automation to collect and validate evidence, detect control failures, identify missing or inconsistent artefacts, maintain traceability and initiate risk-based remediation with appropriate human oversight.

• Define safeguards for AI-enabled controls, including data protection, model governance, explainability, access restrictions, validation, audit logging, exception handling and human approval for material decisions.

• Lead internal and external IAM audits from planning through closure, ensuring that evidence is complete, accurate and timely, and serve as the principal liaison for auditors, Quality, Risk, Finance, Legal and control owners.

• Own findings, deficiencies and corrective and preventive actions, including root-cause analysis, risk assessment, accountable owners, target dates, validation of closure and prevention of recurrence.

• Define key control indicators, compliance dashboards and executive reporting covering control effectiveness, evidence completeness, exceptions, ageing, risk exposure and remediation progress.

• Partner with IAM engineering, application owners and business process owners to embed controls by design, simplify evidence production and reduce manual audit effort without weakening assurance; coordinate dependencies, resolve blockers and drive agreed actions through to completion.

• Build and lead a high-performing team through workforce planning, clear objectives, coaching, delegation, quality review and performance accountability, fostering a culture of ownership, compliance discipline, collaboration and continuous improvement.

• undefined

Basic Qualifications:

• Degree in information security, technology, risk, audit or a related discipline, or equivalent professional experience.

• Substantial experience in IAM governance, risk and compliance, with ownership of audit controls in a complex, highly regulated enterprise.

• Strong working knowledge of SOX IT general controls and GxP requirements as they apply to identity lifecycle management, access governance, privileged access and electronic records.

• Proven experience designing control frameworks, risk and control matrices, test procedures, evidence requirements and control-to-regulation traceability.

• Hands-on experience managing access certifications, segregation of duties, privileged access controls, identity risk monitoring, audit requests and remediation of control deficiencies.

• Demonstrated ability to automate control monitoring, evidence collection, testing and issue workflows using IAM, GRC, ITSM, analytics or orchestration platforms.

• Practical understanding of Agentic AI, including multi-step agent workflows, tool integration, retrieval-based evidence analysis, governance guardrails and human-in-the-loop decision controls.

• Proven experience leading and developing multidisciplinary teams and major programmes, translating strategy into executable plans, managing priorities and dependencies, and ensuring delivery through influence across Cyber Security, Quality, Finance, Internal Audit, Risk, Legal, Technology and business functions.

• Excellent written and verbal communication skills, with the ability to translate control performance and compliance risk into clear executive decisions

Preferred Qualifications:

• Advanced experience with SailPoint, Saviynt or a comparable identity governance platform, including certification, policy, role and analytics capabilities.

• Knowledge of GxP computerised system controls, data integrity principles, electronic records and signatures, validation expectations, and risk-based assurance.

• Relevant certification such as CISA, CISSP, CRISC, CGEIT, ISO 27001 Lead Auditor, SailPoint or Saviynt platform certification.

• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Typical tools and technologies: SailPoint, Saviynt, Archer, ServiceNow, Power BI.

#AGTech

Skills

Account Lifecycle Management, AI Governance, Authentication Systems, Automation Technology, Certificate Management, Cloud Based Services, Cloud IAM, Computer Programming, Configuration Management (CM), Control Monitoring, Database Management, Design Controls, Directory Services, Identity Access Management (IAM), Identity Lifecycle Management, Information Technology (IT) Risk Management, Infrastructure Security, Oracle Identity and Access Management (IAM) Tools Administration, Privileged Access Management (PAM), Security Controls, System Monitors, Troubleshooting

 

 

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at [email protected] to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing [email protected], so that we can confirm to you if the job is genuine.