GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.
Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.
Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.
Domain focus: Portfolio-wide product governance and vendor management across all security product domains.
Job Purpose:
Run day-to-day vendor governance for the managed service under delegated authority over SLA enforcement and service credits, escalating commercial breach to the function head. You own the security portfolio that sits behind it — the tool estate, its contracts and its renewal calendar — including oversight of platform support as it transitions to the vendor.
About the team:
Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.
What makes this role different. This role is commercial and contractual as much as technical. You will hold a vendor to account on performance and cost for services GSK depends on, where your levers are contractual rather than direct operational control. The OTO transition for platform support happens on your watch, and the operational risk during it is real. If your background is running services rather than governing ones you do not control, that is the transition to be ready for.
Key responsibilities:
This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:
• Own vendor governance for the managed service as a whole: performance, SLA management, escalation and commercial levers.
• Run the vendor governance forums and keep decisions and rationale traceable.
• Own oversight of platform support as it moves into the function and transitions to the OTO model.
• Hold accountability for outcomes across more than 30 vendor-operated platforms and the data fabric, while the vendor operates them.
• Own the security portfolio view across products, projects and vendor services.
• Escalate systemic vendor issues rather than managing the same failure repeatedly.
• Hold the vendor to the delivery commitments in each domain product owner's roadmap, and escalate missed milestones through the Vendor Governance Board rather than renegotiating them bilaterally.
• Bring vendor performance evidence — SLA attainment, service credit history and cost per platform — to the annual portfolio review so renewal decisions are made on evidenced delivery rather than incumbency.
• Hold the vendor relationship personally — you have no team, and your leverage is the contract, the governance forum and the evidence you bring to it.
• Support audit and regulatory evidence requests relating to vendor governance.
• Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK's Responsible AI, privacy and security requirements.
• Hold the boundary with Procurement and Legal explicitly: this role sets the commercial requirement and the performance case, Procurement negotiates and Legal contracts.
Basic Qualifications:
• 15+ years in cyber security in a regulated environment — domain focus: portfolio-wide product governance and vendor management across all security product domains
• Operating vendor governance beneath a product management operating model — SLA regime design, service credit mechanics, escalation ladders and QBR and EBC cadence across a multi-tower managed service.
• Translating threat and risk intelligence into capability investment decisions, running the annual portfolio review with a product owner, business case and renewal decision for every tool
• Chairing the Vendor Governance Board — SLA performance, commercial management and relationship health — with automated reporting and acting as primary interface to Procurement
• Governing AI-enabled security products and vendors' use of AI — AI feature claims, data usage terms and AI risk in contracts
Preferred Qualifications:
• Product management discipline — roadmaps, adoption metrics and decommission business cases
• Portfolio analytics, licence utilisation and renewal calendar management, with dashboards and renewal alerts automated
• Product or portfolio management certification (Pragmatic Institute, MSP or equivalent)
• Regulated industry experience, including GxP
• Stakeholder management across CISO, Procurement and domain product owners
• Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.
• Typical tools and technologies: Vendor performance and SLA reporting, contract and renewal management, governance forums with QBR and EBC packs, service credit and commercial mechanics, ServiceNow, portfolio and product management platforms, Power BI for vendor and portfolio reporting.
#AGTech
Skills AI for Cybersecurity, Application Security, Cloud Security, Commercial Events, Computer Programming, Contract Agreements, Data Security, Identity Access Management (IAM), Information Systems, Infrastructure Security, ML Security, Operating Systems Security, Procurement Negotiations, Product Governance, Scripting, Security Engineering, Security Technologies, Security Testing, Vendor Management, Vulnerability Management
Why GSK? Uniting science, technology and talent to get ahead of disease together.
GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.
People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.
Inclusion at GSK: As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.
Please contact our Recruitment Team at IN.recruitment-adjustments@gsk.com to discuss your needs.
Important notice to Employment businesses/ Agencies GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.
It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.
GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.
If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing askus@gsk.com, so that we can confirm to you if the job is genuine.