Vice President, Chief Information Security Officer (CISO)

Job description

Who We Are:Neurocrine Biosciences is a leading biopharmaceutical company with a simple purpose: to relieve suffering for people with great needs. We are dedicated to discovering, developing and commercializing life-changing treatments for patients with under-addressed neurological, psychiatric, endocrine and immunological disorders. The company's diverse portfolio includes FDA-approved treatments for tardive dyskinesia, chorea associated with Huntington's disease, classic congenital adrenal hyperplasia, hyperphagia in Prader-Willi syndrome, endometriosis* and uterine fibroids*, as well as a robust pipeline including multiple compounds in mid- to late-phase clinical development across our core therapeutic areas. For more than three decades, we have applied our unique insight into neuroscience and the interconnections between brain and body systems to treat complex conditions. We relentlessly pursue medicines to ease the burden of debilitating diseases and disorders, because you deserve brave science. For more information, visit neurocrine.com, and follow the company on LinkedIn, X, Facebook and YouTube. (*in collaboration with AbbVie) At Neurocrine, strong leadership drives both business results and team success. We look for leaders who think strategically, anticipate what’s ahead and set clear direction, while building and empowering high-performing teams. Successful leaders foster an environment where people are motivated to do their best work and deliver meaningful, measurable impact through sound decision-making and accountability. About the Role:Provides strategic and organizational leadership for the company’s information security and cybersecurity program, establishing the vision, strategy, governance, architecture, policies, and controls necessary to protect the company’s information, technology, and digital assets. Serves as a trusted advisor to executive leadership and partners across the enterprise to identify and manage cyber risk while enabling business objectives, innovation, and an effective employee and customer experience. Safeguards the scientific, clinical, and corporate data that underpin Neurocrine’s drug discovery and development mission, including GxP-validated systems and clinical trial platforms. Builds advocacy, trust, and shared accountability for security across the organization through strong cross-functional partnership, clear and effective communication, sound judgment, and proactive stakeholder engagement. Balances the urgency of security and risk mitigation with business priorities, operational needs, regulatory requirements, and user experience to implement controls that are appropriately risk-based, practical, scalable, and sustainable. Leads and develops a high-performing cybersecurity organization and fosters a culture in which security is viewed as an enterprise enabler and shared responsibility. Anticipates the organizational impact of security decisions, effectively influences stakeholders at all levels, and ensures cybersecurity capabilities evolve with the company’s business strategy, technology landscape, and threat environment. Partners directly with the Board of Directors and Audit/Risk Committee to ensure cyber risk oversight is embedded in enterprise governance._ Your Contributions (include, but are not limited to): Assess the current state of the information security program and develop and execute a strategic roadmap to evolve and mature cybersecurity capabilities in alignment with the company’s business strategy, risk profile, regulatory requirements, and technology environment Identify and assess information security priorities, emerging threats, vulnerabilities, and control gaps; monitor compliance with established standards and policies; and apply sound, risk-based judgment to prioritize remediation based on business impact, likelihood, and organizational risk Establish annual and long-range security and compliance goals, strategies, performance metrics, reporting mechanisms, maturity models, and roadmaps that demonstrate measurable improvement in cybersecurity capabilities and risk reduction Develop and oversee a comprehensive Identity and Access Management strategy and architecture, including appropriate governance, privileged access, authentication, authorization, and lifecycle management Serve as a trusted cybersecurity advisor to executive leadership and business leaders, translating complex cybersecurity risks into clear business implications, options, and recommendations that enable informed decision-making Represent Neurocrine’s information security posture and program with key customers, partners, regulators, auditors, and other internal and external stakeholders, as appropriate Create a culture of information security awareness through effective training, communications, and engagement programs that promote shared accountability for protecting company information and systems Collaborate proactively with cross-functional leaders to understand business and technical requirements and develop security solutions that appropriately balance risk mitigation, regulatory requirements, business enablement, operational practicality, and employee/user experience Build alignment with impacted stakeholders before implementing significant security policies, controls, technologies, or changes; anticipate downstream organizational impacts and establish appropriate change management, communication, and adoption plans Exercise sound executive judgment regarding the urgency, sequencing, and proportionality of cybersecurity actions, balancing immediate security concerns with broader enterprise priorities and operational considerations Lead the company’s cybersecurity incident preparedness and response capabilities, including executive coordination, crisis management, escalation, investigation, containment, recovery, and lessons learned in partnership with Legal, Privacy, IT, Communications, and other appropriate functions Provide the Board of Directors and executive leadership with clear, concise, and appropriately calibrated reporting on cybersecurity risk, threat landscape, program maturity, significant incidents, priorities, and progress Establish effective cybersecurity governance and risk-management processes, including clear decision rights, escalation thresholds, risk acceptance processes, third-party cybersecurity risk management, and appropriate coordination with enterprise risk management. Given Neurocrine’s reliance on CROs, CDMOs, and other outsourced partners across the drug development and manufacturing supply chain, third-party risk management should explicitly address this extended regulated ecosystem Build, lead, develop, and retain a high-performing cybersecurity organization; establish clear accountability and expectations while fostering collaboration, constructive challenge, professional development, and strong partnerships across IT and the broader company Continuously evaluate emerging technologies, including cloud, data, AI and automation, to understand both new cybersecurity risks and opportunities to improve security capabilities and operational effectiveness Ensure the security, integrity, and availability of GxP-validated systems (e.g., LIMS, MES, clinical trial and pharmacovigilance platforms) in partnership with Quality, IT, and R&D, maintaining alignment with applicable data integrity requirements Protect Neurocrine’s drug discovery, clinical, and manufacturing intellectual property and trade secrets from theft by sophisticated threat actors — including nation-state and industrial espionage activity common in the biotech/pharma sector — in partnership with R&D, Legal, and IP Counsel Other duties as assigned Requirements:24+ years equivalent combination of education and experience Bachelor’s degree in an applicable field AND 20+ years of applicable experience OR Master’s degree AND 16+ years of applicable experience OR JD, PharmD, or PhD AND 14+ years of appl