Head DDIT ISC Software Development Governance, Integrity & Secure Software Development Life Cycle (SDLC)

Description

The company builds and buys software used in clinical trials, patient safety, manufacturing, quality systems and commercial operations. Releases now ship weekly instead of yearly, and the software is increasingly AI-assisted and contains AI. The existing control framework was designed for a slower pace.

This role aims to make secure, compliant, audit-ready delivery the quickest route for engineers rather than a checkpoint they work around. You will own the enterprise SDLC governance model and build much of it yourself, including policy as code, automated evidence capture, pipeline controls and reference architectures.

This is a hands-on individual contributor leadership role. You will set direction across the enterprise and influence hundreds of engineers through a federated community. You will not manage a large team, and you will spend significant time in repositories, pipelines and control code. Those seeking pure oversight or people management should not apply.

Responsibilities

• Own enterprise policies, standards and controls for software engineering, covering source control, branching, peer review, testing, release management, environment segregation, change control, configuration and release documentation.
• Merge overlapping GxP, SOX, privacy, security and IT quality requirements into one risk-based framework, so low-risk internal tools are not held to the standard of regulated clinical systems.
• Remove SDLC controls that add no risk reduction, and build tooling that speeds up secure software delivery across the company at very large scale, using and creating AI tools for the enterprise.
• Implement policy as code and controls as code: branch protection, mandatory review, signed commits, segregation of duties, deployment approvals and immutable audit trails.
• Build continuous, automated evidence pipelines and define control metrics such as coverage, exceptions, drift, mean time to remediate and control effectiveness, prioritising agility, automation and speed.
• Own secure-by-default guardrails in golden pipelines and paved-road platforms, aligned with NIST SSDF, ISO/IEC 27001 and IEC 62304 where they apply.
• Define controls for AI-assisted engineering: acceptable use of coding assistants and agentic tools, IP and licence exposure, provenance, attribution, and human accountability for review and approval.
• Define controls for products that contain AI: model lifecycle, dataset and model documentation, evaluation, drift monitoring, explainability, human oversight, and preparation for changing regulations.
• Use AI to cut compliance workload, for example by drafting risk assessments, mapping controls, generating tests, triaging deviations and synthesising documentation. Act as technical authority for inspections, audits, certifications and SDLC remediation.
• Lead a federated community of engineering, quality, security and compliance practitioners. Publish practical guidance, advise senior leaders on risk and trade-offs, and work with software developers across the enterprise to deliver compliant, secure products efficiently.

Requirements

• You are a practitioner with substantial hands-on software engineering experience. You have written production code, owned CI/CD pipelines, and can read and change pipeline configuration, IaC and policy code without help. Expect a technical assessment.
• At least 10 years in software engineering, platform engineering, DevSecOps or engineering quality, including senior technical ownership of delivery pipelines at scale.
• You have designed and run automated controls in regulated environments and replaced manual compliance work with software.
• You work fluently with regulated software requirements for pharma and life sciences: GxP, GAMP 5 (2nd Edition), CSA, 21 CFR Part 11, EU Annex 11, and data integrity under ALCOA+.
• You have depth in security engineering: application security, software supply chain security, secrets and identity management, and vulnerability management.
• You have credible technical judgement on AI in the SDLC, covering both the tools and their governance implications.
• You can influence without formal authority across engineering, quality and business teams, and you hold your position with senior stakeholders and auditors.
• Excellent written English.
• Desirable: experience in pharma, biotech, medical devices or another regulated industry such as finance, aviation or nuclear, with real inspection or audit exposure.
• Desirable: experience with SOX ITGC in engineering settings, IEC 62304 or SaMD, and privacy by design under GDPR.
• Desirable: hands-on work with modern stacks, including Git platforms and their policy and protection features, container orchestration, cloud, IaC, policy engines such as OPA/Rego or equivalent, test automation frameworks, and SBOM and signing tools.

Conditions

Expected annual base salary: CZK 2,292,080.00 to CZK 4,256,720.00, set according to gender-neutral criteria such as skills, competencies and experience under the company pay policy, and reviewed periodically after joining.

You may be eligible for a performance-based bonus.

Flexible and hybrid working is offered where possible.

Benefits and pay may vary by country and are subject to local law and any applicable collective bargaining agreement. Full details will be shared during the application process.

Equal opportunity: the company is committed to an inclusive workplace and to diverse teams that reflect the patients and communities it serves.

Benefits

• Benefits in kind such as insurance and retirement plans, wellbeing resources and global recognition programmes.
• At least 14 weeks of paid parental leave.