Senior Manager, Site Risk in London

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

The Senior Manager, Site Risk leads the site and OT risk monitoring, indexing and automation capability that supports GSK’s business-facing Technology Risk and Compliance teams across R&D labs and Supply Chain sites, providing continuous visibility into the assets, threats, risks and control effectiveness operating in those environments. This is a delivery leadership role combining hands‑on work with team and stakeholder management.

About the team: Site Risk provides the continuous monitoring, risk indexing and automation that GSK’s business-facing Technology Risk and Compliance teams rely on to understand and manage cyber exposure at GSK’s physical sites: the manufacturing plants, laboratories and R&D campuses where IT and operational technology meet. This position builds the risk intelligence, data and visibility that enables risk and compliance conversations with site leadership.

Key responsibilities:

• Lead a defined area of the capability, including its people, delivery and outcomes.
• Develop team capability through coaching, review and structured feedback.
• Represent the area in CSO governance and cross-functional forums.
• Build and maintain a deep understanding of the assets, threat intelligence, risks and controls operating across R&D labs and Supply Chain sites, spanning both IT and OT.
• Build and run continuous control monitoring across sites to provide ongoing visibility into control operating effectiveness across IT and OT, synthesizing asset understanding and threat intelligence to provide a holistic and continuous view of risk.
• Own and govern the Site Cyber Risk Index model, ensuring it accurately reflects site risk posture, is trusted by stakeholders and clearly recommends prioritized actions.
• Build out key risk and performance indicators, and automation, to help business-facing Technology Risk and Compliance teams drive and track action and remediation at their sites.
• Partner with the business partnering teams who own the site risk and compliance relationship, providing them with the data, indices and tooling they need to engage site leadership effectively.
• Perform ad hoc risk assessments across sites as needed.
• Engage cyber defence and cyber architecture and solutions teams to commission services such as penetration testing and detailed architectural reviews.
• Partner with OT engineering teams to understand the operating environment of the technology being assessed.
• Partner with the Risk Intelligence and Decision Support team on gathering and visualising site risk data.
• Track site remediation through to closure and escalate where sites do not act.

Why you?

We are looking for professionals with the following required skills to achieve our goals:

Basic Qualifications:

• Degree in a relevant discipline, or related experience.
• Demonstrated experience in technology or OT risk in an operational site context.
• Working knowledge of site or plant risk assessment.
• Practical experience with stakeholder engagement with site and engineering leadership.
• Strong background in network security, OT security and operating in regulated environments.
• Experience building or operating continuous control monitoring, risk indices or key risk/performance indicator models.
• Experience partnering with penetration testing, red team or architecture review functions to assess control effectiveness.
• Significant experience in cyber security within the relevant domain.
• Proven experience leading a team or a substantial programme of work.
• Experience managing delivery to plan, quality and timelines.
• Excellent relationship management, influencing and communication skills.

Preferred Qualifications:

• Familiarity with IEC 62443 and OT security in manufacturing or laboratory settings.
• Working knowledge of NIST CSF and ISO 27001.
• Experience in pharmaceutical or another regulated manufacturing industry.
• Willingness to travel to sites as required.
• Relevant certification such as CRISC, CISM, CISSP, GICSP.
• Experience in pharmaceutical, life sciences or another highly regulated industry.
• Experience partnering with data or analytics teams to build dashboards, indices and visualisations of risk data.

This role is based in the United Kingdom and offers a hybrid working model, with 2/3 days a week onsite at our central London HQ.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

GSK is an Equal Opportunity Employer. This ensures that all qualified applicants will receive equal consideration for employment without regard to race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), parental status, national origin, age, disability, genetic information (including family medical history), military service or any basis prohibited under federal, state or local law.

We believe in an agile working culture for all our roles. If flexibility is important to you, we encourage you to explore with our hiring team what the opportunities are.