Information Security & Privacy Governance Expert

About the role

Roche is looking for an Expert in Information Security & Privacy Advisory (ISPA) in Madrid. The ISPA team acts as the strategic bridge between IT, business and legal functions, and the expert moves beyond compliance checks to become a high-impact partner for System Owners and global engineering hubs. The role leads security and privacy risk assessments to operationalize Security and Privacy-by-Design principles for complex digital initiatives such as AI platforms and enterprise systems.

Key responsibilities

• Execute Security Expert Reviews (SER) for complex, high-risk systems, with deep technical and privacy evaluations
• Negotiate risk-mitigating control objectives with business and technical stakeholders and define clear risk ownership
• Collaborate on Security Design Patterns and Technical Baselines for emerging technologies such as Generative AI, cloud-native security and advanced data platforms
• Bridge IT, Legal and Data Protection Officers to turn global legal requirements into technical and organizational controls
• Advise business and IT owners on Roche's Information Security Management System (ISMS) and external legal mandates
• Support strategic functions such as R&D, Commercial and P&C across global and local contexts
• Manage advisory queues in Integrated Risk Management (IRM) platforms such as ServiceNow with audit-ready consistency
• Maintain quality through a four-eye peer review culture and share knowledge across the global team
• Lead initiatives to streamline risk assessment workflows, including automation and AI efficiencies

Required profile

• 10+ years in IT security, Governance, Risk and Compliance (GRC) in complex, global environments
• Proven track record of Information Risk Assessments, Data Protection Impact Assessments (DPIA) and cross-border data transfer reviews
• Deep knowledge of GDPR, CCPA/CPRA and regulatory alignment such as DoJ 28 CFR Part 202
• Degree in Computer Science, Law, Information Technology or equivalent practical experience
• Certifications such as CISSP, CISM, CRISC, AIGP or ISO 27001 Lead Auditor highly valued; CIPP/E or CIPM a significant plus

Required skills

• Strong command of information security frameworks such as ISO 27001 and NIST
• Practical insight into cloud platforms (AWS, GCP, Azure), AI orchestration layers and Security/Privacy-by-Design
• Ability to translate legal and policy mandates into engineering requirements
• Experience with IRM systems such as ServiceNow IRM is a plus