IT Strategic Risk & Audit Manager

Bei Roche kannst du ganz du selbst sein und wirst für deine einzigartigen Qualitäten geschätzt. Unsere Kultur fördert persönlichen Ausdruck, offenen Dialog und echte Verbindungen. Hier wirst du für das, was du bist, wertgeschätzt, akzeptiert und respektiert. Dies schafft ein Umfeld, in dem du sowohl persönlich als auch beruflich wachsen kannst. Gemeinsam wollen wir Krankheiten vorbeugen, stoppen und heilen und sicherstellen, dass jeder Zugang zur Gesundheitsversorgung hat – heute und in Zukunft. Werde Teil von Roche, wo jede Stimme zählt.

Die Position

At Roche, we believe every patient deserves a personalized healthcare solution. As theIT Strategic Risk& Audit Manager, you will play a pivotal role in ensuring that our digital evolution—from AI-driven drug discovery to personalized healthcare apps—is built on a foundation of trust and resilience. You will act as a strategic partner to Digital Technology leaders, ensuring that risks are managed proactively rather than reactively.

This role moves beyond tactical "checkbox" auditing to focus onstrategic foresight—anticipating shifts in the threat landscape, regulatory environment, and emerging technologies (like AI and Cloud architecture)

Job Responsibilities

Scope / (Content Leadership): Defines the strategic vision for IT risk, audit, and compliance, and drives strategic initiatives for long-term risk management success. Initiates and leads large, complex projects with a significant impact on the organization. Leads the development of enterprise-wide risk and compliance policies and advises on emerging trends and best practices.

Strategic Risk Architecture& Vision: Define and architect the global IT Enterprise Risk Management (ERM) framework (NIST, ISO 27001, COBIT), aligning long-term digital strategy with Roche’s risk appetite to ensure "Compliance by Design" across complex, interconnected global portfolios.

Accountability/Problem Solving: Leads the analysis of highly complex business and risk challenges with significant organizational impact, proactively identifying potential strategic issues within your sphere of influence. Develops comprehensive risk management and compliance policies, implements proactive measures to avoid repeated issues, and leads initiatives to anticipate and mitigate future risks. Contributes to framing strategic questions and facilitates strategic decision-making at the executive level.

Stakeholder Management: Identifies and engages key stakeholders at the executive level and external partners, analyzing enterprise-wide stakeholder landscapes. Leads enterprise-wide risk, audit, and compliance initiatives, presenting them to executive leadership to secure support and strategic alignment for risk-related investments. Navigates highly complex and politically sensitive landscapes, acting as an organizational trust builder and providing expert counsel on critical strategic decisions.

E2E Audit& Compliance Leadership: Lead the full lifecycle of complex IT audits and continuous monitoring programs across infrastructure and applications, ensuring the organization meets global regulatory requirements while proactively identifying systemic issues to prevent recurrence.

Inspection Command& Control: Serve as the primary IT liaison during complex Health Authority inspections (FDA, EMA, etc.), leading "Front-Room/Back-Room" operations, coaching SMEs in regulatory interview techniques, and ensuring the rapid delivery of high-quality, validated evidence.

Data Integrity& ALCOA+Systematically audit and enforce the "Digital Thread" to ensure all health-regulated data remains Attributable, Legible, Contemporaneous, Original, and Accurate, maintaining the integrity of life-saving digital health solutions.

Global Stakeholder& Transformation Management: Navigate sensitive landscapes to lead enterprise-wide risk initiatives, partnering with IT owners to develop robust remediation CAPAs and innovating risk management approaches to drive lasting, transformative impact across the global organization.

Qualifications

Education / Experience

15+ years of experience in IT Risk/Audit, preferably within a global, highly regulated industry (Pharma, MedTech, or Finance).

Deep mastery ofGxP (GLP, GCP, GMP),CSV (Computer System Validation), andData Integrity principles (ALCOA+).

Expert knowledge of global risk frameworks (NIST, ISO 27001, COBIT) and privacy regulations (GDPR, HIPAA).

Strong understanding of modern technology stacks, includingCloud Security (AWS/Azure), AI/ML governance, and Agile/DevSecOps methodologies.

Demonstrated experience presenting to and influencingExecutive Leadership (C-suite) and Board-level stakeholders.

Proven ability tonavigate a complex, global matrixed environment and steer senior leadership toward risk-aware decision-making through technical credibility.

Drives a culture of shared accountability, ensuring that compliance and risk management are viewed as strategic enablers rather than organizational hurdles.

Certifications: Mandatory possession of at least two of the following: CISA,CRISC,CISM, orCISSP.

#RDT2026

Where pay transparency applies, details are provided based on the primary posting location. For this role, the primary location is Madrid. If you are interested in additional locations where the role may be available, we will provide the relevant compensation details later in the hiring process.

Wer wir sind

Eine gesündere Zukunft treibt uns zur Innovation an. Mehr als 100.000 Mitarbeiter weltweit arbeiten gemeinsam daran, wissenschaftliche Fortschritte zu erzielen und sicherzustellen, dass jeder Zugang zur Gesundheitsversorgung hat – heute und für zukünftige Generationen. Durch unser Engagement werden über 26 Millionen Menschen mit unseren Medikamenten behandelt und mehr als 30 Milliarden Tests mit unseren Diagnostik-Produkten durchgeführt. Wir ermutigen uns gegenseitig, neue Möglichkeiten zu erkunden, Kreativität zu fördern und hohe Ziele zu setzen, um lebensverändernde Gesundheitslösungen zu liefern.

Gemeinsam können wir eine gesündere Zukunft gestalten.

Roche ist ein Arbeitgeber, der die Chancengleichheit fördert.