Data Security & Privacy Lead
At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.
The Position
At Roche, we thrive to deliver more benefits to our patients as part of our 10-year Pharma vision. An integral part of achieving this vision is to deliver new and innovative data analytics solutions to our scientists across Pharma Technical Operations (PT). To do so, we have formed a new organization called PT Digital and Operational Excellence (PTE) with the aspiration to digitally transform and become a lean organization.
PTE catalyzes the global development and execution of PT’s Digital and Operational Excellence strategy to enable PT to realize our performance promises. We build a strong cross-functional and inclusive community, put the power of data into the hands of our people, further develop Lean and Digital skills across PT, and scale up our Digital and Advanced Analytics solutions, for the benefit of our colleagues and patients.
As we establish a PT-wide Data Governance framework to orchestrate sustainable solutions, we are looking for a Data Security & Privacy Lead. In this role, you will be responsible for ensuring the security, privacy, and compliance of PT data. You will collaborate widely with PT regulatory functions, IT, and business stakeholders to define, implement, and monitor policies in line with industry standards. This role is critical in our ongoing dedication to ensuring patient safety and regulatory compliance, requiring a strong understanding of data privacy and security needs in a life sciences organization.
The Opportunity
As our Data Security & Privacy Lead, your main responsibilities will be divided into four core pillars:
1. Security & Privacy Policy Definition and Implementation
Work closely with relevant Roche IT, legal, and regulatory functions to define policies for data acquisition, storage, usage, and deletion to ensure security and privacy across the data lifecycle.
Partner with System Owners, Data Owners, and IT to ensure security and privacy policies are relevant and applied adequately to existing systems across PT.
Conduct impact assessments and define implementation strategies for new and updated policies, working closely with business partners to effectively and consistently implement policy.
2. Security & Privacy Compliance
Collaborate with business domains to effectively monitor privacy and security compliance across multiple systems and platforms.
Support business domains to appropriately respond to data subject requests and regulatory requirements in a compliant and timely manner.
Ensure PT data adheres to regulatory requirements and global data protection laws and regulations (e.g., GDPR, DPA).
Coordinate architectural design decisions affecting security and privacy by design principles throughout the solution development lifecycle.
3. Advisory & Advocacy
Act as the primary point of contact and provide expertise for staff regarding data privacy and protection obligations, including information governance activities and information security.
Continuously train, upskill, and raise awareness for privacy and security maturity in PT. Lead policy-specific awareness activities, working with the Data Culture Lead where relevant to ensure PT-wide understanding and effective adoption.
4. Risk Monitoring & Escalation
Conduct regular risk assessments and security audits, scoping and suggesting mitigations to ensure data security and privacy practices are adhered to, and the risk of future incidents is reduced.
Leverage comprehensive knowledge of Roche escalation pathways and risk mitigation to escalate emerging issues based on impact assessment—taking targeted action to mitigate risks to patient safety and regulatory non-compliance.
Who You Are
You are a dynamic, structured, and collaborative professional who thrives in environments undergoing digital evolution. You possess strong analytical skills, an eye for detail, and the ability to influence and manage relationships effectively across a global matrix organization.
To be successful in this role, you should bring:
Experience: Minimum of 5+ years of experience in data security, governance, and privacy management, preferably within the life sciences or healthcare industry.
Education: Bachelor’s or Master’s degree in Information Security, Cyber Security, Computer Science, or a related field.
Technical Expertise: * Familiarity with data protection frameworks, audits, and compliance processes.
Proven experience with data security, governance, and privacy tools/technologies (e.g., DLP, Cloud Platforms like GCP, AWS, Azure, and IT/OT data repositories such as Snowflake or Data Historians).
Solid experience working with DSARs, DPIAs, audits, RoPA, and managing data breaches.
Core Skills: Strong communication skills with the ability to clearly articulate complex technical issues to non-technical stakeholders. Proven capability to analyze risks, provide strategic guidance, and resolve issues effectively.
Who we are
A healthier future drives us to innovate. Together, more than 100’000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.
Let’s build a healthier future, together.
Roche is an Equal Opportunity Employer.