Director, Information Security Regulatory Assurance

About the role

The Director, Information Security Regulatory Assurance is responsible for establishing and leading a sustainable enterprise capability to demonstrate compliance with applicable cybersecurity regulatory, statutory, and industry assurance requirements.

This role provides strategic leadership and operational oversight for the organization's cybersecurity regulatory assurance portfolio, including NIS2, CCPA, U.S. Department of Justice data security requirements, China MLPS, SWIFT, and PCI, as well as emerging requirements that create cybersecurity audit, assessment, certification, attestation, or evidence obligations.

The Director will translate regulatory requirements into practical assurance expectations, coordinate readiness and assessments across Information Security, technology teams, business organizations, affiliates, manufacturing sites, R&D locations, and provide leadership with clear visibility into readiness, risk, deficiencies, and remediation.

Responsibilities

• Strategy & Influence: Work with domain senior leadership and make contributions to develop strategy. Adapt and execute domain strategic plans. (Information Security Regulatory Assurance Strategy & Governance)
• Cyber Regulatory Portfolio Leadership: Manage and communicate the assurance calendar and priorities.
• Control & Evidence Assurance / Continuous Monitoring and Issues, Risk & Remediation
• Liaison & Relationship Building: Build collaborative relationships and effectively interact frequently with business and/or technology senior leaders. Interactions focused on project and operational decisions. Interact well with diverse groups within function and maintain strong working relationships with internal and external collaborators. (Audit, Assessment & Attestation Management)
• Decisions & Policies: Make key decisions that are guided by established strategies and priorities. Influence operating policies and procedures that affect the domain based on changes in the regulatory environment. Interpret enterprise-wide policies, processes and procedures that may affect teams and domain workflow. (Regulatory Change & Emerging Requirements)
• Strategy & Influence: Work with domain senior leadership and make contributions to develop strategy. Adapt and execute domain strategic plans. (Executive Reporting & Stakeholder Management)
• Process Improvement & Optimization: Drive opportunities to improve process and/or technology. (Assurance Transformation & Continuous Improvement)

Qualifications & Requirements

Required

• Bachelor's Degree and 10 years of experience; Master's Degree and 9 years of experience. PhD and 5 years of experience.
• Significant experience in cybersecurity governance, risk, compliance, audit, assurance, or regulatory programs.
• Ability to communicate problems in terms that are understandable to BTS Leadership and end users at all levels.
• Subject matter expert in technology and/or business domain.
• Demonstrated experience leading complex, cross-functional assurance, regulatory or audit initiatives.
• Strong knowledge of cybersecurity controls, control testing, evidence, remediation, and audit practices.
• Ability to interpret regulatory requirements and translate them into operational control and assurance requirements.

Preferred

• Master's Degree preferred.
• Experience in the pharmaceutical industry preferred.
• Experience with several of the following:
• NIS2
• ISO/IEC 27001
• NIST Cybersecurity Framework
• NIST SP 800-53
• CCPA cybersecurity requirements
• China MLPS
• SWIFT Customer Security Controls Framework
• PCI DSS
• Relevant certifications may include CISA, CISM, CISSP, CRISC, ISO 27001 Lead Auditor/Lead Implementer or equivalent credentials.

Additional Information

Applicable only to applicants applying to a position in any location with pay disclosure requirements under state or local law:

• The compensation range described below is the range of possible base pay compensation that the Company believes in good faith it will pay for this role at the time of this posting based on the job grade for this position. Individual compensation paid within this range will depend on many factors including geographic location, and we may ultimately pay more or less than the posted range. This range may be modified in the future.
• We offer a comprehensive package of benefits including paid time off (vacation, holidays, sick), medical/dental/vision insurance and 401(k) to eligible employees.
• This job is eligible to participate in our long-term incentive programs.

Note: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable. The amount and availability of any bonus, commission, incentive, benefits, or any other form of compensation and benefits that are allocable to a particular employee remains in the Company's sole and absolute discretion unless and until paid and may be modified at the Company's sole and absolute discretion, consistent with applicable law.