Associate Director, DDIT ISC Cyber Defense

Salary Range: €57,900.00 - €107,500.00 Job Description Summary Supports the delivery of the global ISC Country & Awareness program, with focus on country-specific information security requirements and initiatives, cybersecurity regulatory compliance, information security advisory, and security awareness. The role also drives the practical adoption of AI and automation across ISC activities, including AI-assisted development and vibe coding, while helping address security requirements and risks arising from the use of AI technologies. Partners with country and global stakeholders to address local security needs, translate regulatory and business requirements into practical security measures, strengthen security behaviors, and improve the effectiveness and efficiency of ISC activities. Works closely with Security Operations Center (SOC) and cyber defense teams to translate country, regulatory, threat, and incident insights into improved monitoring and new or enhanced detection rules. Job Description #LI-Hybrid Location: Barcelona, Spain Key Responsibilities: • Drive implementation and ongoing compliance with country-specific cybersecurity, privacy, AI, and critical infrastructure regulations. • Act as a trusted ISC advisor, guiding business and DDIT stakeholders on security policies, controls, and secure practices. • Support cybersecurity audits, regulatory inspections, and certifications, including evidence preparation and remediation. • Manage country-level security risks, issues, and incidents, collaborating with SOC, threat detection, incident response, and cyber defense teams. • Design and deliver impactful security awareness and training programs, including phishing simulations, targeted training, and campaigns. • Use security behavior data and insights to identify risks and develop targeted awareness interventions. • Partner across ISC, DDIT, and business functions to coordinate regulatory, security, and country-specific initiatives. • Leverage AI, automation, low-code/no-code, and AI-assisted development to streamline compliance, reporting, awareness, and security processes. • Assess AI-related security risks, including data exposure, access controls, prompt injection, insecure integrations, third-party risks, and misuse. • Monitor KPIs, emerging cyber threats, regulations, and technology trends, translating insights into improved controls, SOC detection capabilities, and security services. Essential Requirement : • 8+ years of experience in information security, with strong experience in security governance, cybersecurity regulatory compliance, security risk management, information security advisory, or related areas. • Demonstrated experience implementing cybersecurity or technology regulatory requirements in a multinational environment, ideally including NIS2 or comparable national cybersecurity and critical infrastructure regulations. • Strong knowledge of established information security frameworks and standards, such as ISO/IEC 27001, NIST Cybersecurity Framework and related security control frameworks. • Experience translating information security and regulatory requirements into practical solutions within complex business and technology environments. Experience supporting security risk management, audits, regulatory assessments, inspections or compliance programs. • Strong stakeholder management, communication and influencing skills, with the ability to explain complex cybersecurity topics to technical and non-technical audiences. • Hands-on experience using generative AI and AI coding assistants for rapid prototyping or vibe coding, with the ability to build practical automations, integrations, workflows or lightweight applications. Experience may include tools such as GitHub Copilot, Microsoft Copilot, Power Platform, or comparable technologies. • Good understanding of AI security risks and controls, including secure AI adoption, data protection, identity and access management, third-party or model risk, prompt injection, sensitive-data leakage, human oversight, monitoring and responsible use. • Working knowledge of SOC operating processes, including security monitoring, alert triage, incident escalation, threat-informed detection engineering, detection-rule lifecycle management, testing and tuning. Ability to collaborate with SOC teams to establish new detection use cases and rules based on country, regulatory or threat requirements. Desirable Requirement : • Recognized information security certification such as CISSP, CISM, CRISC, CISA, CCSP, or ISO 27001 Lead Implementer/Lead Auditor. Experience designing or delivering security awareness and behavior-change programs, including phishing simulations, targeted awareness campaigns, or security training. • Experience with security automation, SIEM or security analytics platforms, and development collaboration practices such as version control, testing and documentation. Experience with Microsoft Sentinel, Microsoft Defender XDR, Kusto Query Language (KQL), or comparable technologies are advantageous. Experience working within a large, global, and highly regulated organization, preferably within the pharmaceutical, healthcare or life sciences industry. Benefits & Rewards At Novartis, we’re committed to reimagining medicine together - and rewarding the people who make it happen. Expected Annual Base Salary Range for role: 57,900.00 - 107,500.00 EUR The base salary offered is determined based on gender-neutral objectives, such as relevant skills, competencies and experience in accordance with the Novartis pay setting policy and upon joining Novartis will be reviewed periodically. In addition to your base salary, you may be eligible for a performance-based bonus depending on certain performance parameters. The rewards of being part of our team go far beyond base pay and incentives. We also offer a variety of competitive benefits in kind to help you thrive personally and professionally, such as insurance plans, re