Director, Information Security Governance Risk Compliance

Viatris is a global healthcare company uniquely positioned to bridge the traditional divide between generics and brands, combining the best of both to more holistically address healthcare needs globally. With a mission to empower people worldwide to live healthier at every stage of life, we provide access at scale, currently supplying high-quality medicines to approximately 1 billion patients around the world annually and touching all of life's moments, from birth to the end of life, acute conditions to chronic diseases.

We have been included on number of award lists that demonstrate the impact we are making.

Every day, we rise to the challenge to make a difference and here’s how the Director, Information Security Governance Risk Compliance role will make an impact:

The primary purpose of the Director, Governance, Risk & Compliance (GRC) is to provide strategic leadership and enterprise oversight for the GRC program supporting the organization’s cybersecurity, privacy, quality, and regulatory obligations. The Director is responsible for establishing and maturing enterprise-wide cybersecurity governance processes, risk management frameworks, compliance monitoring activities, third-party risk management, and audit readiness programs. This role partners with executive leadership, legal, privacy, quality, manufacturing, and global technology teams to ensure cybersecurity risks are identified, communicated, and managed in alignment with business objectives and regulatory requirements applicable to the pharmaceutical industry including GxP, HIPAA, SOX, GDPR, and FDA expectations. The Director leads cross-functional initiatives, develops strategic roadmaps, directs remediation priorities, and ensures effective communication of cyber risk posture to executive leadership and governance committees.

Key responsibilities for this role include:

• Develop and maintain enterprise cybersecurity governance, risk, and compliance strategies aligned with organizational objectives and regulatory requirements.

• Direct enterprise risk assessments, compliance reviews, and control maturity evaluations across business and technology environments.

• Lead development and implementation of cybersecurity policies, standards, procedures, and governance frameworks.

• Provide strategic oversight for audit readiness activities supporting internal audits, regulatory inspections, and third-party assessments.

• Review and communicate enterprise cyber risk posture, key risk indicators, and remediation priorities to executive leadership and governance committees.

• Oversee third-party cybersecurity risk management processes including supplier risk evaluations and contractual security requirements.

• Coordinate enterprise-wide remediation strategies for vulnerabilities, audit findings, and risk treatment plans.

• Guide strategic planning and budgeting activities for cybersecurity governance and compliance initiatives.

• Collaborate with legal, privacy, quality, manufacturing, and IT leadership to align cybersecurity governance with enterprise risk management objectives.

• Support development of business continuity and operational resilience strategies for critical business processes.

• Partner with architecture and engineering teams to ensure security controls and compliance requirements are integrated into technology solutions.

• Promote cybersecurity awareness and risk-informed decision making across business functions and leadership teams.

• Support organizational initiatives involving mergers, acquisitions, and digital transformation by evaluating cybersecurity and compliance risks.

The minimum qualifications for this role are:

• Minimum of a Bachelor’s degree with a focus in MIS ,IT or Engineering or equivalent is required.  Masters degree in MIS, IT, Engineering or related is preferred.  Related experience and/or education may be considered.

• Minimum of eight years of IT or Cybersecurity experience is required.

• Knowledge of cybersecurity and privacy principles, frameworks, and regulatory requirements applicable to global pharmaceutical organizations.

• Knowledge of enterprise risk management methodologies, governance structures, and compliance assessment techniques.

• Knowledge of audit practices, internal controls, and regulatory compliance requirements including SOX, HIPAA, GDPR, and GxP expectations.

• Knowledge of third-party risk management concepts and vendor governance processes.

• Knowledge of incident management, vulnerability management, and security operations governance.

• Knowledge of security architecture concepts, cloud technologies, and data protection methodologies.

Exact compensation may vary based on skills, experience, and location. The salary range for this position is $112,000.00 - $236,000.00 USD.

At Viatris, we offer competitive salaries, benefits and an inclusive environment where you can use your experiences, perspectives and skills to help make an impact on the lives of others.

Viatris is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, national origin, religion, age, color, sex, sexual orientation, gender identity, gender expression, disability, or protected veteran status, or any other characteristic protected by local, state, or federal laws, rules, or regulations.