Associate Director - IAM Operations and Governance

Job description

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems. Our diverse portfolio consists of vaccines, specialty medicines, and general medicines. Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges. Job Purpose: The Associate Director, IAM Operations and Governance will lead the team responsible for IAM audit controls and compliance governance across the identity estate. This hands-on role will set direction, translate strategy into an executable roadmap, assign clear ownership, remove delivery barriers and ensure commitments are completed to the required quality and timelines. The role will design and operate a modern, automated IAM control environment for SOX, GxP and other regulatory obligations, including continuous monitoring, evidence collection, control-to-evidence traceability, findings management and sustainable remediation. It will also lead the adoption of agentic AI and workflow automation to reduce manual effort, improve control effectiveness and provide audit-ready assurance. About the team: IAM Operations and Governance owns the control layer over GSK's identity estate: access certification, segregation of duties, identity risk reporting and the audit evidence that proves access is under control. Key responsibilities: This role will provide you the opportunity to lead key initiatives: Lead the IAM controls, audit assurance and compliance governance capability, including its people, operating model, roadmap, delivery and outcomes; set clear priorities, delegate effectively and hold the team accountable for execution. Own the IAM control framework for SOX, GxP and other applicable regulatory and enterprise requirements, ensuring clear control objectives, ownership, frequency, procedures and accountability. Establish continuous controls monitoring across joiner, mover and leaver processes, access approvals, access certification, segregation of duties, privileged access, service accounts, orphaned accounts and excessive or stale access. Design and implement an automated control library that maps each control to its policy and regulatory requirement, systems in scope, control owner, required evidence, test procedure, exception criteria and remediation workflow. Apply Agentic AI and workflow automation to collect and validate evidence, detect control failures, identify missing or inconsistent artefacts, maintain traceability and initiate risk-based remediation with appropriate human oversight. Define safeguards for AI-enabled controls, including data protection, model governance, explainability, access restrictions, validation, audit logging, exception handling and human approval for material decisions. Lead internal and external IAM audits from planning through closure, ensuring that evidence is complete, accurate and timely, and serve as the principal liaison for auditors, Quality, Risk, Finance, Legal and control owners. Own findings, deficiencies and corrective and preventive actions, including root-cause analysis, risk assessment, accountable owners, target dates, validation of closure and prevention of recurrence. Define key control indicators, compliance dashboards and executive reporting covering control effectiveness, evidence completeness, exceptions, ageing, risk exposure and remediation progress. Partner with IAM engineering, application owners and business process owners to embed controls by design, simplify evidence production and reduce manual audit effort without weakening assurance; coordinate dependencies, resolve blockers and drive agreed actions through to completion. Build and lead a high-performing team through workforce planning, clear objectives, coaching, delegation, quality review and performance accountability, fostering a culture of ownership, compliance discipline, collaboration and continuous improvement. undefined Basic Qualifications: Degree in information security, technology, risk, audit or a related discipline, or equivalent professional experience. Substantial experience in IAM governance, risk and compliance, with ownership of audit controls in a complex, highly regulated enterprise. Strong working knowledge of SOX IT general controls and GxP requirements as they apply to identity lifecycle management, access governance, privileged access and electronic records. Proven experience designing control frameworks, risk and control matrices, test procedures, evidence requirements and control-to-regulation traceability. Hands-on experience managing access certifications, segregation of duties, privileged access controls, identity risk monitoring, audit requests and remediation of control deficiencies. Demonstrated ability to automate control monitoring, evidence collection, testing and issue workflows using IAM, GRC, ITSM, analytics or orchestration platforms. Practical understanding of Agentic AI, including multi-step agent workflows, tool integration, retrieval-based evidence analysis, governance guardrails and human-in-the-loop decision controls. Proven experience leading and developing multidisciplinary teams and major programmes, translating strategy into executable plans, managing priorities and dependencies, and ensuring delivery through influence across Cyber Security, Quality, Finance, Internal Audit, Risk, Legal, Technology and business functions. Excellent written and verbal communication skills, with the ability to translate control performance and compliance risk into clear executive decisions Preferred Qualifications: Advanced experience with SailPoint, Saviynt or a comparable identity governance platform, including certification, policy, role and analytics capabilities. Knowledge of GxP computerised system controls, data integrity principles, electronic records and signatures, validation expectations, and risk-based assurance. Relevant certification such as CISA, CISSP, CRISC, CGEIT, ISO 27001 Lead Auditor, SailPoint or Saviynt platform certification. Experience in pharmaceutical, life sciences or another highly regulated industry. Typical tools and technologies: SailPoint, Saviynt, Archer, ServiceNow, Power BI. #AGTech Skills Account Lifecycle Management, AI Governance, Authentication Systems, Automation Technology, Certificate Management, Cloud Based Services, Cloud IAM, Computer Programming, Configuration Management (CM), Control Monitoring, Database Management, Design Controls, Directory Services, Identity Access Management (IAM), Identity Lifecycle Management, Information Technology (IT) Risk Management, Infrastructure Security, Oracle Identity and Access Management (IAM) Tools Administration, Privileged Access Management (PAM), Security Controls, System Monitors, Troubleshooting Why GSK? Uniting science, technology and talent to get ahead of disease together. GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale. People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matt