IT Strategic Risk & Audit Manager

About the role

Roche is looking for an IT Strategic Risk & Audit Manager in Madrid. The role acts as a strategic partner to Digital Technology leaders, moving beyond tactical auditing to anticipate changes in the threat landscape, regulatory environment and emerging technologies such as AI and cloud architecture. It covers scope definition, enterprise risk architecture, audit leadership, inspection liaison and data integrity.

Key responsibilities

• Define the strategic vision for IT risk, audit and compliance, lead large, complex projects and develop enterprise-wide risk and compliance policies.
• Architect the global IT Enterprise Risk Management (ERM) framework (NIST, ISO 27001, COBIT) and promote compliance by design.
• Analyze complex business and risk challenges, frame strategic questions and advise executive leadership on risk-related investments.
• Engage executive-level and external stakeholders and present risk, audit and compliance initiatives to secure support.
• Lead the full lifecycle of complex IT audits and continuous monitoring, and serve as the primary IT liaison during Health Authority inspections (FDA, EMA, etc.).
• Enforce the ALCOA+ data integrity principles across the digital thread.
• Partner with IT owners to develop remediation CAPAs and drive transformation across the global organization.

Required profile

• 15+ years of experience in IT risk and audit, preferably in a global, highly regulated industry (pharma, medtech or finance).
• Deep mastery of GxP (GLP, GCP, GMP), CSV and data integrity (ALCOA+).
• Proven experience presenting to and influencing C-suite and Board-level stakeholders.
• Ability to navigate a complex global matrixed environment.
• Certification: mandatory possession of at least two of CISA, CRISC, CISM or CISSP.

Required skills

• NIST, ISO 27001, COBIT and GDPR/HIPAA knowledge.
• Cloud security (AWS/Azure), AI/ML governance and Agile/DevSecOps.