Director - Automation Engineer / Product Manager

Overview

Serve as the quality, governance and product authority for Cyber Architecture & Solutions, acting as the independent quality gate before security solutions are handed to the global managed service vendor, and owning the security product portfolio, vendor governance and the change programme capability.

What you'll do

• Define, own and continuously improve the Cyber Architecture and Solutions governance and quality framework, including the assurance process, pass or fail criteria for vendor handover and the exception regime, applying design standards owned by the Architecture function rather than authoring them.
• Own and operate the independent design assurance process, making binding pass or fail determinations on vendor handover readiness.
• Lead a 17-role function spanning Design Assurance, Security Product Management, and vendor and portfolio governance.
• Own the Cyber Architecture and Solutions security product portfolio, including product roadmaps, full lifecycle management from introduction to decommission, and prioritisation against GSK's cyber risk appetite.
• Hold ultimate commercial accountability for vendor governance across the managed service, including performance, SLA, escalation and commercial levers, and oversight of platform support as it transitions to the OTO model, with day-to-day governance delegated to the Associate Director for vendor governance.
• Own security risk and exception management at the most senior level, including assessing complex architectural risk exceptions, maintaining the risk register, and escalating material unmitigated risk.
• Own Cyber Architecture and Solutions-wide metrics and security posture reporting, and present performance evidence to the CISO, ExCo and Board-level risk committees.
• Lead engagement with internal audit, external regulators and the second and third lines of defence, evidencing design quality and governance effectiveness.
• Own portfolio intelligence and investment analytics so prioritisation decisions are evidence-based.
• Protect the independence of assurance when it is commercially or politically inconvenient.
• Own the function's budget and the security tooling spend envelope, and defend the consolidation savings committed in the annual plan against the renewal calendar.

What you'll need

• 15+ years in cyber security, including 7+ in senior leadership in a regulated environment leading leaders across geographies, with a domain focus as function head for cyber security product management and Design Assurance across the Cyber Architecture and Solutions portfolio.
• End-to-end product management of cyber security products, including threat-led use-case definition, business case and investment, roadmap, vendor evaluation and selection, onboarding, adoption and value tracking, renewal and decommission, running capabilities as products with outcome KPIs (coverage, adoption, efficacy, cost per capability).
• Building and leading a cyber security product management practice with domain product owners for each domain group, each mirrored to a Security Solution Engineering squad working in parallel, and technical deep dives proving product efficacy and integration.
• Leading an independent Design Assurance practice and governing a security managed service, with binding pass or fail decisions on handover readiness made against standards owned by the Architecture function and never by you, supported by drift detection, QBRs and EBCs.
• Leading AI adoption across the portfolio and assurance, including AI-enabled tool evaluation, assurance of agentic solutions and AI-driven lifecycle automation from intake to decommission.

Nice to have

• Architecture literacy to make binding quality judgements on expert architecture output they do not own, expressed as non-conformance to a specific standard clause.
• Delivering enterprise security tool rationalisation with quantified savings, sequenced against renewal dates, with automated utilisation and renewal analytics.
• Evidencing design and product governance to internal audit, external audit and regulators, producing decisions, approvals and exceptions on demand.
• Credibility with Board-level risk committees, presenting assurance outcomes, portfolio performance and residual risk directly.
• Commercial acumen, including multi-year vendor contracts, TCO and cost-to-serve modelling.

Details

• Location: Bengaluru, India.