CSV Supplier Oversight Lead
Lilly · United States, Indianapolis IN
At Lilly, the work is demanding because patients are waiting. We unite caring with discovery to help make life better for people around the world, knowing that every decision, every detail, and every day matters. Headquartered in Indianapolis, Indiana, our over 50,000 employees around the globe take on complex challenges to discover and deliver life-changing medicines, strengthen how health is understood and managed, and support the communities we serve. This is hard, urgent, selfless work—but it’s work worth doing. If you’re driven by purpose and ready to bring your best to work that truly matters for patients, we invite you to join us.
Position Description:
The CSV External Services Lead is an individual-contributor Quality technical lead role within the Global Information Systems Quality (GISQ) organization. The role serves as the enterprise subject matter expert (SME) and quality oversight lead for the suppliers and third parties that develop, host, operate, support, or validate Lilly’s GxP computerized systems, and is responsible for:
- Leading risk-based quality management of computerized system suppliers and third-party service providers across all service models, including commercial off-the-shelf (COTS) software, configured and custom development, Software-as-a-Service (SaaS), Platform-/Infrastructure-as-a-Service (PaaS/IaaS) and cloud hosting, managed IT services, and outsourced CSV/managed-service providers.
- Owning the computerized system supplier assessment, from risk-based planning and scheduling through assessment execution, reporting, and requalification.
- Managing audit observations and reports through supplier response, CAPA, verification of effectiveness, and closure, escalating when commitments are not met or residual risk is unacceptable.
- Defining and approving the quality requirements in Quality Technical Agreements (QTAs) and the quality-relevant terms of Service Level Agreements (SLAs), partnering with Procurement, Legal, and service owners so that GxP responsibilities are clearly allocated and enforceable.
- Monitoring supplier quality performance against QTAs, SLAs, and KPIs, conducting periodic supplier quality reviews, and directing corrective action when performance deviates from expectations.
- Seeking and interpreting regulatory expectations for outsourced activities and supplier oversight (e.g., EU GMP Chapter 7 and Annex 11, 21 CFR Part 11, ICH Q9(R1) and Q10, ICH E6(R3)) and translating them into controlled procedures and supporting policies.
- Representing computerized system supplier oversight during health authority inspections and audits, demonstrating that Lilly retains accountability for outsourced GxP activities.
- Serving as a point of escalation for GISQ CSQA representatives and business partners on supplier quality matters, including supplier-related deviations, supplier change notifications, and unresolved audit findings.
- Partnering with Procurement, Legal, Cyber Security, Privacy, and Tech@Lilly sourcing/vendor management to integrate quality requirements into the full supplier lifecycle, from selection and onboarding through exit.
- Serving as a member of the GISQ Technical Review Board, providing direction on enterprise-wide computer system discussions and coaching/mentoring across the network.
Key Objectives/Deliverables:
Supplier and Third-Party Quality Oversight
- Managed-Service Oversight: For outsourced CSV and managed-service providers, oversee the quality obligations within contracts and statements of work (SOWs), supplier performance, service planning, continuity of knowledge and staffing, and transition obligations.
- Assessments: Oversee the risk-assessment process (on-site, remote, and questionnaire-based assessments), leveraging independent certifications and attestations (e.g., ISO 9001, ISO/IEC 27001, SOC 2 Type II) where appropriate, and issue reports within defined timelines.
- Assessment Observations and Reports: Classify observations, evaluate supplier responses and CAPA plans, verify effectiveness, and track findings to closure.
- Quality Technical Agreements: Author, negotiate, approve, and periodically review QTAs that define GxP responsibilities such as change and release notification, incident and security breach notification, data integrity, backup and restore, record retention, audit rights, subcontractor management, and data return and deletion at exit.
- Supplier Changes and Subcontractors: Ensure supplier-initiated changes (e.g., SaaS releases, infrastructure changes, subcontractor changes) are received and assessed for impact to the validated state, in partnership with the CSV Common Process Lead and system owners.
Maintain Inspectional Readiness
- Ensure supplier qualification records, audit reports, QTAs, and supplier performance evidence are current, complete, and retrievable for inspections.
- Ensure all quality actions and commitments related to supplier oversight are appropriately tracked in Quality/CAPA plans and completed on time.
- Provide periodic updates to GISQ leadership and key stakeholders on the supplier risk profile, audit program status, open observations, and emerging supplier risks.
Deliver Projects, Programs, and Support
- Provide consultation/interpretation on computer system procedures related to supplier management, while appropriately escalating computer system quality issues.
- Be a GISQ/Tech@Lilly process owner for computerized system supplier management procedures.
- Connect with and influence other QMS groups (e.g., GxP supplier quality and audit functions) and Procurement’s third-party risk processes to harmonize supplier oversight and avoid duplicate audits.
- As part of ‘account management’, create and maintain periodic touchpoints with strategic suppliers and internal service owners to discuss trends, performance, upcoming changes, and areas of concern.
- Review/approve documents per CSV expectations within agreed service levels, or clearly communicate when activities will be completed.
Streamline and Continuously Improve
- Eliminate non-value-added activities in supplier oversight by right-sizing assessment depth and frequency to risk.
- Standardize QTA templates, audit checklists, and assessment questionnaires by service model to reduce cycle time and improve consistency.
- Understand external trends and potential ramifications for the supplier base and supported IT area(s).
Grow Capabilities and Knowledge
- Liaise and develop networks with other Quality organizations (e.g., BQA, GxP supplier quality and audit functions).
- Share lessons learned from audits and supplier events, and best practices, with others in GISQ and across the enterprise, coaching and mentoring others on technical matters to build on Lilly’s Quality culture.
- Be proactive in benchmarking supplier oversight practices both internal and external to Lilly.
Minimum Requirements:
· Bachelor degree in a science, engineering, computer science/systems, or pharmaceutical-related field; or equivalent experience.
· Prior role experience in Computer System Validation, including working knowledge of GAMP 5, 21 CFR Part 11, EU GMP Annex 11, and regulatory expectations for outsourced activities and supplier oversight.
· Prior role experience planning, leading, and reporting assessments of computerized system suppliers or IT service providers, including managing observations through closure.
· Prior role experience authoring or negotiating Quality Technical Agreements and defining quality-relevant SLA requirements in partnership with Procurement and Legal.
· Prior role experience managing supplier or managed-service relationships, including contracts, SOWs, and performance management, without formal people-management responsibility.
· Working knowledge of cloud and outsourced service models (SaaS, PaaS, IaaS, managed services) and their shared-responsibility implications for GxP compliance.
· Experience