Lead Analyst, Design Assurance & Product Management - Application Security

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: Design Assurance for Application Security, Data Security and Cloud Security.

Job Purpose:

Domain analyst covering Application Security, Data Security and Cloud Security, plus ownership of the Design Assurance register. You perform pre-production and BAU reviews for tooling in these domains and maintain the register that assurance coverage is reported from.

About the team. Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.

What makes this role different. Three domains plus register ownership, so the role combines review work with a practice-wide responsibility. The register is what assurance coverage and audit evidence are reported from, which means accuracy is not negotiable. You verify against standards the architecture domains set; you do not write them. Appetite to build breadth across AppSec, data and cloud matters more than deep expertise in one.

Key responsibilities:

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Perform pre-production reviews for application security tooling including SAST, DAST and SCA, validating against AppSec architecture standards, SDLC integration patterns and API security controls.

• Review data security tooling including DLP and data classification against data security architecture standards.

• Review cloud security tooling and landing-zone configurations against the cloud security standards — CSPM policy baselines, CIEM entitlement boundaries, key management and network isolation across the Azure and GCP estates — and record where a deviation is an accepted exception rather than a gap.

• Keep your review records current in the assurance register, to the evidence standard audit will test.

• Run pre-production and business-as-usual reviews across Application Security, Data Security and Cloud Security, escalating cross-domain and precedent-setting designs to senior review.

• Record each finding against the specific clause of the Application, Data or Cloud security standard it breaches, and track it to evidenced closure.

• Validate vendor-delivered SAST, DAST and SCA toolchain configurations against the secure SDLC integration patterns they were specified to meet.

• Flag recurring findings as candidate standards gaps for escalation to the owning architecture domain.

• Prepare review packs and evidence for governance forums.

• Support audit and regulatory evidence requests from the register.

• Use approved AI tools in your day-to-day work to improve your own productivity and your team's ways of working, sharing what works and applying sound judgement, including validating outputs and following GSK's Responsible AI, privacy and security requirements.

Basic Qualifications:

• 10+ years in cyber security — domain focus: Design Assurance for Application Security, Data Security and Cloud Security

• Pre-production design assurance reviews of Application Security, Data Security and Cloud Security tooling

• Reviewing SAST, DAST, SCA, DLP, data classification, CSPM and CIEM configurations against standards

• Owning the assurance register — finding status, SLA tracking and remediation evidence — with review packs and findings documented using automated templates and Critical/High findings escalated

• Reviewing AI application and data security controls — LLM application security, GenAI DLP and AI-SPM configurations

Preferred Qualifications:

• SDLC integration and API security controls

• Encryption management and data access governance

• Multi-cloud security control consistency — plus policy-as-code or scripting

• GxP-compliant documentation practice

• Reviewing API security controls and secrets handling in CI/CD pipelines, where the finding is usually in the integration rather than the tool.
• Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.
• Typical tools and technologies: SAST, DAST and SCA toolchain review, CSPM and cloud configuration review, DLP and data classification tooling review, API security validation, secure SDLC integration patterns, assurance register ownership, ServiceNow.

#AGTech

Skills

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at IN.recruitment-adjustments@gsk.com to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing askus@gsk.com, so that we can confirm to you if the job is genuine.