Head DDIT ISC Software Development Governance, Integrity & Secure Software Development Life Cycle (SDLC)

Description

The team builds and buys software that serves commercial operations, quality management, manufacturing, patient safety and clinical trials.

Software now ships weekly instead of yearly, and more of it is built with AI assistance and contains AI. The control framework was designed for a slower period.

The role makes secure, compliant, audit-ready delivery the quickest route for engineers, not an obstacle they work around. You will own the enterprise SDLC governance model and build much of it yourself through policy as code, automated evidence capture, pipeline controls and reference architectures.

This is a hands-on individual contributor leadership role. You will set direction across the enterprise and influence hundreds of engineers through a federated community, but you will not manage a large team. Expect substantial time in repositories, pipelines and control code. Roles focused purely on oversight or people management are not a fit.

Responsibilities

• Own enterprise policy, standards and controls across the software lifecycle: source control, branching, peer review, testing, releases, environment separation, change control, configuration and release documentation.
• Consolidate overlapping GxP, SOX, privacy, security and IT quality requirements into one risk-based framework, so low-risk internal tools are not held to the rules of regulated clinical systems.
• Remove SDLC controls that add no risk reduction, and build tooling that speeds up delivery at high enterprise scale, including AI tools you create.
• Implement policy and controls as code: branch protection, mandatory review, signed commits, segregation of duties, deployment approvals and immutable audit trails.
• Build continuous evidence pipelines and telemetry covering coverage, exceptions, drift, mean time to remediate and control effectiveness, prioritising speed and automation.
• Own secure-by-default guardrails in golden pipelines and paved-road platforms, aligned with NIST SSDF, ISO/IEC 27001 and IEC 62304 where they apply.
• Define controls for AI-assisted engineering: acceptable use of coding assistants and agentic tools, IP and licence exposure, provenance, attribution, and human accountability for review and approval.
• Define controls for products that contain AI: model lifecycle, dataset and model documentation, evaluation, drift monitoring, explainability, human oversight, and readiness for changing regulation.
• Use AI to cut compliance effort, such as drafting risk assessments, mapping controls, generating tests, triaging deviations and synthesising documentation. Act as technical authority for inspections, audits, certifications and SDLC remediation.
• Lead a federated community of engineering, quality, security and compliance practitioners, publish practical guidance, advise senior leaders on risk trade-offs, and work with developers across the enterprise.

Requirements

• You are a practitioner with substantial hands-on software engineering experience: you have written production code, owned CI/CD pipelines, and can read and change pipeline configuration, IaC and policy code without help. A technical assessment is part of selection.
• You have 10+ years in software engineering, platform engineering, DevSecOps or engineering quality, including senior technical ownership of delivery pipelines at scale.
• You have designed and run automated controls in regulated settings, and have replaced manual compliance work with software.
• You have working knowledge of pharma and life sciences software rules: GxP, GAMP 5 (2nd Ed.), CSA, 21 CFR Part 11, EU Annex 11 and data integrity under ALCOA+.
• You have depth in security engineering: application security, software supply chain security, secrets and identity management, and vulnerability management.
• You have sound technical judgement on AI in the SDLC, covering both the tools and their governance.
• You can influence without formal authority across engineering, quality and business teams, and hold your position with senior stakeholders and auditors.
• You write excellent English.
• You bring business acumen, influencing skills, information security risk management, IT governance, stakeholder management, strategic leadership and talent development.
• Desirable: experience in pharma, biotech, medical devices or another regulated sector such as finance, aviation or nuclear, including real inspection or audit exposure.
• Desirable: experience with SOX ITGC in engineering, IEC 62304 or SaMD, and privacy by design under GDPR.
• Desirable: hands-on work with modern stacks, including Git platforms and their protection features, container orchestration, cloud, IaC, policy engines such as OPA/Rego, test automation frameworks, and SBOM and signing tools.

Conditions

Expected annual base salary: €92,600.00 to €172,000.00 (EUR).

Hybrid working.

Base pay is set on gender-neutral criteria such as skills, competencies and experience, under the company pay policy, and is reviewed periodically after you join.

Pay and benefits vary by country and may be subject to local law and collective bargaining agreements. Full package details are shared during the application process.

The company is committed to an inclusive workplace and to teams that reflect the patients and communities it serves.

Benefits

• You may be eligible for a performance-based bonus, depending on performance parameters.
• Benefits in kind include insurance plans, retirement plans, wellbeing resources and global recognition programmes.
• Flexible and hybrid working options are offered where possible.
• Minimum 14 weeks of paid parental leave.