Cybersecurity & Privacy Risk and Compliance Manager
Roche · Sant Cugat del Vallès, Spain
At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.
The PositionPosition Overview
The Cybersecurity & Privacy Risk Manager leads the development, execution, and continuous optimization of a robust, unified cybersecurity and privacy risk management framework across the enterprise. Operating globally within a Scaled Agile Framework (SAFe) environment, this role ensures that technology, digital healthcare solutions, and information assets remain secure, compliant, and resilient against evolving threats.
By translating risk data into strategic actionable insights, the Risk Manager enables key decision-makers—from tactical Business Risk Owners to Senior Executive Leadership—to make informed, proactive decisions regarding risk tolerance, investment priorities, and governance.
Key Responsibilities
- Risk Assessment & Framework Execution: Drive comprehensive risk assessments across global business operations and product groups, identifying potential cybersecurity and privacy vulnerabilities, operational risks, and regulatory exposures.
- Executive & Governance Reporting: Formulate quantitative and qualitative risk reports and dashboards tailored for both operational Risk Owners and Senior Management decision-makers, establishing clear exposure visibility and strategic mitigation paths.
- Risk Tolerance & Strategy Alignment: Define, monitor, and enforce risk tolerance thresholds aligned with overall business goals and regulatory mandates (GDPR, HIPAA, ISO standards).
- Thought Leadership & Remediation Advisory: Provide expert consultative guidance on remediation strategies, risk treatment plans, and process improvements, demonstrating ROI on risk mitigation investments.
- Cross-Functional & Global Collaboration: Partner closely with global Security, Privacy, Legal, Quality & Regulatory, and Business units to embed security-by-design and privacy-by-design principles throughout the organizational lifecycle.
Requirements & Experience
- Education: Bachelor’s degree in Computer Science, Information Security, Business Information Systems, or a related field (Master’s degree preferred).
- Experience: 6+ years of experience in cybersecurity, privacy risk management, compliance, or information security governance within large-scale, multinational environments.
- Agile & Framework Expertise: Demonstrated experience operating within Scaled Agile (SAFe) and Agile frameworks, managing risks across matrixed development teams and governance levels.
- Compliance & Regulatory Knowledge: Deep familiarity with global privacy regulations (GDPR, HIPAA) and cybersecurity standards (ISO 27001, NIST, CIS).
- Stakeholder Communication: Proven ability to engage, challenge, and influence decision-makers at both operational risk-owner levels and Senior Management forums.
- Industry Background: Prior experience in healthcare, medical diagnostics, pharmaceuticals, or regulated digital software environments is strongly preferred.
Preferred Qualifications & Certifications
- Relevant industry certifications: CISA, CISM, CRISC, CISSP, ISO 27001 Lead Auditor, or equivalent.
- Strong data analytical capabilities with the ability to build risk models and present metric-driven strategies.
- Exemplary "Zoom Out / Zoom In" capability—able to define overarching global strategies while diving into granular technical risk scenarios when communicating with subject matter experts.
Who we areA healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.
Let’s build a healthier future, together.
Roche is an Equal Opportunity Employer.