Senior Director - Design Assurance & Product Management

Overview

Senior Director leading the quality, governance and product function for Cyber Architecture & Solutions, acting as the independent quality gate for security solutions before handover to the global managed service vendor.

What you'll do

• Define, own and continuously improve the Cyber Architecture and Solutions governance and quality framework, including the assurance process, pass or fail criteria for vendor handover and the exception regime, applying design standards owned by the Architecture function.
• Own and operate the independent design assurance process, making binding pass or fail determinations on vendor handover readiness.
• Lead a 17-role function spanning Design Assurance, Security Product Management, and vendor and portfolio governance.
• Own the Cyber Architecture and Solutions security product portfolio, including product roadmaps and full lifecycle management from introduction to decommission, prioritised against GSK's cyber risk appetite.
• Hold ultimate commercial accountability for vendor governance across the managed service, including performance, SLA, escalation and commercial levers, and oversight of platform support as it transitions to the OTO model, with day-to-day governance delegated to the Associate Director for vendor governance.
• Own security risk and exception management at the most senior level, assessing complex architectural risk exceptions, maintaining the risk register, and escalating material unmitigated risk.
• Own Cyber Architecture and Solutions-wide metrics and security posture reporting, and present performance evidence to the CISO, ExCo and Board-level risk committees.
• Lead engagement with internal audit, external regulators and the second and third lines of defence, evidencing design quality and governance effectiveness.
• Own portfolio intelligence and investment analytics so prioritisation decisions are evidence-based.
• Protect the independence of assurance when it is commercially or politically inconvenient.
• Own the function's budget and the security tooling spend envelope, and defend committed consolidation savings against the renewal calendar.
• Lead your team in using approved AI tools to improve productivity and ways of working, following GSK's Responsible AI, privacy and security requirements.
• Set the technology and opportunity investment agenda for the portfolio, including what to adopt, pilot and retire, including AI-enabled capability.

What you'll need

• 20+ years in cyber security, including 7+ years in senior leadership in a regulated environment leading leaders across geographies.
• End-to-end product management of cyber security products, including use-case definition, business case and investment, roadmap, vendor evaluation and selection, onboarding, adoption and value tracking, renewal and decommission, running capabilities as products with outcome KPIs.
• Experience building and leading a cyber security product management practice with domain product owners mirrored to Security Solution Engineering squads.
• Experience leading an independent Design Assurance practice and governing a security managed service, making binding pass or fail decisions on handover readiness against standards owned by the Architecture function.
• Experience leading AI adoption across the portfolio and assurance, including AI-enabled tool evaluation, assurance of agentic solutions and AI-driven lifecycle automation.
• Bachelor's degree in a relevant discipline, or equivalent professional experience.

Nice to have

• Architecture literacy to make binding quality judgements on expert architecture output they do not own, expressed as non-conformance to a specific standard clause.
• Delivering enterprise security tool rationalisation with quantified savings, sequenced against renewal dates, with automated utilisation and renewal analytics.
• Evidencing design and product governance to internal audit, external audit and regulators, producing decisions, approvals and exceptions on demand.
• Credibility with Board-level risk committees, presenting assurance outcomes, portfolio performance and residual risk directly.
• Commercial acumen, including multi-year vendor contracts, TCO and cost-to-serve modelling.

Details

• Location: Bengaluru, India.