Manager, Global IT Security Operations

Overview

Lead the operational management and continuous improvement of Lonza's information security risk management program, ensuring cybersecurity and technology risks are identified, assessed, documented, monitored and managed. Reports to the Global Head of IT Security & Compliance.

What you'll do

• Lead and continuously improve the IT security risk management program.
• Conduct risk assessments, maintain the security risk register, and drive mitigation and remediation activities.
• Provide risk-based guidance to stakeholders and support risk acceptance decisions.
• Maintain security policies, standards and risk management processes aligned with industry frameworks (e.g., ISO 27001, NIST).
• Support internal and external audits, compliance reviews, and remediation of findings.
• Ensure security requirements are embedded in business and technology initiatives.
• Manage the global third-party cybersecurity risk program.
• Assess security risks of vendors and service providers and oversee remediation of identified gaps.
• Partner with Procurement and business stakeholders to strengthen supply chain security.
• Lead responses to customer security assessments, questionnaires, and due diligence requests.
• Coordinate with cross-functional teams to demonstrate compliance and security capabilities.
• Maintain customer assurance documentation and address evolving customer requirements.
• Develop and report key risk, compliance, and security metrics.
• Facilitate governance reviews and risk reporting for leadership.
• Drive continuous improvement of cybersecurity governance, risk, and compliance processes.

What you'll need

• Bachelor's degree in Information Security, Computer Science, IT, Risk Management, or a related field.
• 8+ years of experience in cybersecurity risk management, governance, compliance, audit, or information security.
• Strong understanding of security frameworks such as ISO 27001 and NIST.
• Experience managing security risk assessments, third-party risk, audits, and compliance activities.
• Excellent stakeholder management, communication, and influencing skills in a global environment.
• Proven ability to drive risk-based decisions, manage competing priorities, and deliver results collaboratively.

Nice to have

• Knowledge of DLP, Privileged Access Management (PAM), and security governance practices.
• Professional certifications such as CISSP, CISM, CRISC, or ISO 27001 Auditor/Implementer.

Details

• Location: Gurugram, hybrid work mode.