IT Audit & Inspection Readiness Senior Specialist

About the role

Roche is looking for an IT Audit & Inspection Readiness Senior Specialist in Madrid. The role sits inside the Governance, Risk and Compliance (GRC) framework and acts as the day-to-day partner for IT and RDT teams during internal audits, external certifications and regulatory inspections. It is an enablement and orchestration role rather than a traditional audit role focused on testing and issuing findings.

Key responsibilities

• Act as the single point of contact between IT/RDT teams and incoming audit or inspection teams, triage requests, clarify ambiguous ones and filter out duplicate or out-of-scope demands.
• Review and validate evidence requests before submission, making sure they answer the auditor's request and protect sensitive data.
• Standardize request channels, analyze repeated evidence and manage the audit calendar to avoid operational disruption.
• Work with RDT subject matter experts and practice owners on root-cause analysis of audit findings and track remediation milestones until final sign-off with auditors.
• Keep the central GRC tool updated with active engagements, artifact repositories, control mappings and open finding statuses.
• Build reusable, standardized evidence packages for recurring controls and trend analysis such as workload distribution and finding aging.
• Once the reactive cycle stabilizes, run lightweight Control Self-Assessments (iCSAs) against baseline frameworks to spot gaps early.

Required profile

• At least 5 years of practical experience in IT audit, IT compliance, GRC coordination or an IT service/operations role with substantial audit exposure.
• Degree in Computer Science, Information Systems, Engineering, Business Informatics or equivalent practical tech background.
• Fluent English, able to write, present to international teams and communicate across distributed teams.

Required skills

• Working familiarity with IT infrastructure, cloud architectures, IAM, backup/resilience and change management is a plus.
• Understanding of control frameworks such as ISO 27001, NIS2 and SOX ITGC is a plus.
• Proven experience aligning processes with ISO standards (9001, 13485, 27001), GxP, FDA mandates (21 CFR Part 11, Annex 11), SOX ITGC and data privacy laws (GDPR, CCPA).
• Certifications such as CISA, CRISC, ISO/IEC 27001 Lead Implementer/Auditor or ITIL Foundation are a plus.