Associate Director - IAM Operations and Governance

Overview

Lead the IAM Operations and Governance team responsible for IAM audit controls and compliance governance across GSK's identity estate, including design and operation of an automated control environment for SOX, GxP and other regulatory obligations.

What you'll do

• Lead the IAM controls, audit assurance and compliance governance capability, including its people, operating model, roadmap, delivery and outcomes; set priorities, delegate effectively and hold the team accountable for execution.
• Own the IAM control framework for SOX, GxP and other applicable regulatory and enterprise requirements, ensuring clear control objectives, ownership, frequency, procedures and accountability.
• Establish continuous controls monitoring across joiner, mover and leaver processes, access approvals, access certification, segregation of duties, privileged access, service accounts, orphaned accounts and excessive or stale access.
• Design and implement an automated control library mapping each control to its policy and regulatory requirement, systems in scope, control owner, required evidence, test procedure, exception criteria and remediation workflow.
• Apply Agentic AI and workflow automation to collect and validate evidence, detect control failures, identify missing or inconsistent artefacts, maintain traceability and initiate risk-based remediation with appropriate human oversight.
• Define safeguards for AI-enabled controls, including data protection, model governance, explainability, access restrictions, validation, audit logging, exception handling and human approval for material decisions.
• Lead internal and external IAM audits from planning through closure, ensuring evidence is complete, accurate and timely, and serve as principal liaison for auditors, Quality, Risk, Finance, Legal and control owners.
• Own findings, deficiencies and corrective and preventive actions, including root-cause analysis, risk assessment, accountable owners, target dates, validation of closure and prevention of recurrence.
• Define key control indicators, compliance dashboards and executive reporting covering control effectiveness, evidence completeness, exceptions, ageing, risk exposure and remediation progress.
• Partner with IAM engineering, application owners and business process owners to embed controls by design, simplify evidence production and reduce manual audit effort without weakening assurance; coordinate dependencies, resolve blockers and drive agreed actions to completion.
• Build and lead a high-performing team through workforce planning, clear objectives, coaching, delegation, quality review and performance accountability.

What you'll need

• Degree in information security, technology, risk, audit or a related discipline, or equivalent professional experience.
• Substantial experience in IAM governance, risk and compliance, with ownership of audit controls in a complex, highly regulated enterprise.
• Strong working knowledge of SOX IT general controls and GxP requirements as they apply to identity lifecycle management, access governance, privileged access and electronic records.
• Proven experience designing control frameworks, risk and control matrices, test procedures, evidence requirements and control-to-regulation traceability.
• Hands-on experience managing access certifications, segregation of duties, privileged access controls, identity risk monitoring, audit requests and remediation of control deficiencies.
• Demonstrated ability to automate control monitoring, evidence collection, testing and issue workflows using IAM, GRC, ITSM, analytics or orchestration platforms.
• Practical understanding of Agentic AI, including multi-step agent workflows, tool integration, retrieval-based evidence analysis, governance guardrails and human-in-the-loop decision controls.
• Proven experience leading and developing multidisciplinary teams and major programmes, translating strategy into executable plans, managing priorities and dependencies, and ensuring delivery through influence across Cyber Security, Quality, Finance, Internal Audit, Risk, Legal, Technology and business functions.
• Excellent written and verbal communication skills, with the ability to translate control performance and compliance risk into clear executive decisions.

Nice to have

• Advanced experience with SailPoint, Saviynt or a comparable identity governance platform, including certification, policy, role and analytics capabilities.
• Knowledge of GxP computerised system controls, data integrity principles, electronic records and signatures, validation expectations, and risk-based assurance.
• Relevant certification such as CISA, CISSP, CRISC, CGEIT, ISO 27001 Lead Auditor, SailPoint or Saviynt platform certification.
• Experience in pharmaceutical, life sciences or another highly regulated industry.

Details

• Location: Bengaluru Luxor North Tower.