Head DDIT ISC - Software Development Governance & Secure SDLC

About the role

Novartis is looking for a Head of DDIT ISC to own the enterprise SDLC governance model and build much of it: policy as code, automated evidence capture, pipeline controls and reference architectures. The role is hands-on and individual-contributor leadership: it sets enterprise direction and influences hundreds of engineers through a federated community, without a large direct team, and includes meaningful time in repositories, pipelines and control code. It is a hybrid position in Barcelona.

Key responsibilities

• Own the enterprise policy, standards and controls for software engineering, covering source control, branching, peer review, testing, release management, environment segregation, change control and documentation.
• Rationalise overlapping GxP, SOX, privacy, security and IT-quality requirements into one risk-based framework, so low-risk internal tools are not governed like regulated clinical systems.
• Retire SDLC controls that do not reduce risk and implement tooling that speeds up secure software development at scale, using and creating AI tooling.
• Implement policy-as-code and controls-as-code, including branch protections, mandatory review, signed commits, segregation of duties, deployment approvals and immutable audit trails.
• Build automated, continuous evidence pipelines and control telemetry (coverage, exceptions, drift, MTTR, effectiveness).
• Define secure-by-default guardrails in golden pipelines and paved-road platforms, aligned with NIST SSDF, ISO/IEC 27001 and IEC 62304 where applicable.
• Define controls for AI-assisted engineering and AI-containing products, including acceptable use, IP and licence exposure, provenance, attribution and human accountability.
• Use AI to reduce compliance burden (risk assessment drafting, control mapping, test generation, deviation triage, documentation synthesis) and act as technical authority for inspections, audits and certifications.
• Lead a federated community of engineering, quality, security and compliance practitioners, publish guidance and advise senior leaders.

Required profile

• Substantial hands-on software engineering experience: writing production code, owning CI/CD pipelines, reading and modifying pipeline configuration, IaC and policy code.
• 10+ years in software engineering, platform engineering, DevSecOps or engineering quality, with senior technical ownership of delivery pipelines at scale.
• Experience designing automated controls in regulated environments, with evidence of replacing manual compliance work with software.
• Fluent knowledge of regulated-software requirements in pharma/life sciences: GxP, GAMP 5 (2nd Ed.), CSA, 21 CFR Part 11, EU Annex 11, data integrity and ALCOA+.
• Security depth: application security, software supply chain security, secrets and identity management, vulnerability management.
• Credible judgement on AI in the SDLC and ability to influence without authority across engineering, quality and business lines.
• Excellent written English.

Required skills

• Git-based platforms and policy/protection features, container orchestration, cloud, IaC, policy engines (e.g. OPA/Rego or equivalent), test automation frameworks, SBOM and signing tooling.
• Desirable: pharma, biotech, medical devices or other regulated industry experience with inspection or audit exposure; SOX ITGC, IEC 62304 / SaMD, privacy-by-design under GDPR.

What we offer

• Base salary range of 92,600 to 172,000 EUR, with a possible performance-based bonus.
• Flexible and hybrid working options where possible, and at least 14 weeks of paid parental leave.
• Insurance plans, retirement plans, wellbeing resources and global recognition programs.