Assoc Dir, Information Security Governance Risk & Compliance

About Servier Servier in the U.S. is a Boston-based, commercial-stage biopharmaceutical company launched by Servier Group in 2018. As a privately held organization, Servier is uniquely positioned to advance cutting-edge science, tackle underserved therapeutic areas and make patients the focus of every strategic decision. Role SummaryThe Associate Director, Information Security Governance Risk and Compliance serves as the functional leader for Governance, Risk and Compliance across the US affiliate, reporting to the Associate Director, Cybersecurity. This role establishes and leads the GRC operating model, governance framework, risk methodology, strategic priorities, and maturity roadmap. The role provides oversight of information security risk management, policy governance, compliance, third-party risk management, control assurance, audit readiness, and risk reporting while directing operational execution through subordinate managers, analysts, contractors, and service providers. This position partners closely with Global Information Security, IT, Legal, Privacy, Procurement, Quality, Internal Audit, and business stakeholders to ensure risks are identified, assessed, communicated, and managed in alignment with enterprise requirements. The role serves as the primary GRC advisor and enables risk-informed decision making by translating information security risk into business, operational, regulatory, and financial impact. This is a high visibility leadership role with the opportunity to build and scale a modern GRC capability aligned to Servier’s global cybersecurity strategy, enterprise risk expectations, regulatory obligations, and business growth.Primary ResponsibilitiesCyber Risk Management and GovernanceEstablish and lead the US information security risk management framework across the affiliateDefine risk assessment methodologies, risk taxonomy, scoring models, reporting standards, and escalation criteriaProvide oversight and challenge of risk assessments performed by the GRC teamEnsure information security risks are clearly defined, consistently assessed, and aligned to Group methodology and enterprise risk expectationsReview material risks, treatment recommendations, mitigation strategies, and risk acceptance proposals before escalationDrive risk-based prioritization of remediation activities, investment recommendations, and control improvement initiativesLocal Risk Coordinator and GRC Program LeadershipServe as the senior US GRC leader responsible for coordinating information security risk governance across the affiliateAct as the primary US liaison to Global Information Security for GRC-related risk, compliance, policy, and assurance activitiesEstablish governance routines, program cadences, reporting expectations, and execution standards for the US GRC functionEnsure alignment between US affiliate execution and Global risk management methodology, policy baselines, and governance expectationsEscalate material risks, systemic issues, overdue remediation, and governance concerns through US and Global governance channelsGovernance, Policy and Control AssuranceEstablish governance expectations for information security policies, standards, procedures, control requirements, and exception managementSponsor the local information security policy lifecycle, ensuring alignment with Global baselines, US business requirements, and regulatory obligationsDefine the control assurance approach used to evaluate control design, implementation, effectiveness, and maturityOversee control monitoring, compliance validation, gap analysis, and continuous improvement activitiesDefine and monitor KPIs and KRIs measuring policy adoption, control maturity, security posture, remediation progress, and governance effectivenessThird-Party Risk and Enterprise Risk IntegrationEstablish the strategic direction for third-party information security risk management across the US vendor ecosystemDefine governance requirements, risk acceptance criteria, assessment standards, and escalation paths for third-party engagementsPartner with Procurement, Legal, Privacy, IT, and business stakeholders to ensure vendor security risks are appropriately assessed and managedOversee integration of third-party security risk into enterprise risk management, procurement processes, contractual reviews, and business decision makingDrive cross-domain alignment across Information Security, IT, Legal, Privacy, Procurement, Quality, and business functionsAudit, Compliance and Assurance OversightOversee information security audit readiness across internal audits, external audits, regulatory engagements, and assurance activitiesEstablish governance over evidence collection, control validation, audit response, remediation tracking, and management reportingEnsure audit findings, compliance gaps, and control deficiencies are translated into clear risk treatment plans with defined owners, timelines, and measurable outcomesPartner with Internal Audit, Quality, Legal, Privacy, and Global Information Security to support assurance activities and regulatory expectationsExecutive Engagement and Cross-Functional InfluenceAct as a trusted advisor on information security governance, risk, compliance, and assurance mattersTranslate complex information security risks into business, operational, regulatory, financial, and reputational impactDeliver executive-level reporting on information security risk posture, governance maturity, compliance status, control effectiveness, and remediation progressSupport governance committees, leadership forums, business reviews, and strategic planning discussions with clear risk-based recommendationsRepresent US GRC priorities in Global information security and enterprise risk forums, influencing alignment where appropriateOrganizational Leadership and Capability BuildingLead and develop the US Information Security Governance Risk and Compliance functionManage GRC managers, analysts, contractors, consultants, managed service providers, and supporting resourcesDefine the GRC organizational structure, operating procedures, quality standards, workforce strategy, and capability development roadmapBuild scalable and repeatable GRC processes aligned to information security maturity objectives and organizational growthIdentify opportunities to improve efficiency through automation, process standardization, documentation quality, tooling, and operating model maturityEducation and Required SkillsMinimum of 8+ years of experience in information security GRC, IT risk management, cybersecurity, compliance, audit, security operations, or related disciplinesMinimum of 3+ years in a leadership role with responsibility for program ownership, people leadership, functional leadership, or management of managersBachelor’s degree preferred in Cybersecurity, Information Technology, Information Systems, Business, Risk Management, or a related fieldDeep expertise in information security risk frameworks and governance models, including NIST CSF 2.0, ISO 27001, PCI, SOX, FAIR, or similar methodologiesExperience leading policy governance, third-party risk management, compliance oversight, audit readiness, control assurance, and remediation governance programsStrong executive communication skills with the ability to influence senior stakeholders in a global, matrixed organizationRelevant certifications such as CISSP, CISM, CRISC, CISA, CGRC, FAIR, or equivalent preferredTravel and LocationOnsite in Boston preferred 1-2 days hybrid; Remote considered with occasional travel to BostonEstimated travel required: 5-10%Servier’s CommitmentServier is committed to modeling diversity, equity, and inclusion within the industry. We are dedicated to fostering an environment that maintains equitable treatment for all and we welcome applicants who are passionate, committed, and innovative individuals. We encourage candidates to apply to our open roles as we are always willing to consider experiences and skills beyond what is listed in the job description.All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.Salary RangeThe salary range for this role is $179,000-$212,000. An employee’s pay position within the salary range will be based on several factors including, but not limited to, relevant education, qualifications, certifications, experience, skills, geographic location, performance, and business or organizational needs. We may ultimately pay more or less than the posted range, and the range may be modified in the future. Employees in this position are also eligible for Short-Term and Long-Term incentive programs. Servier also offers a competitive and comprehensive benefits package that includes benefits such as medical, dental, vision, flexible time off (Servier provides unlimited sick time and flex time, and does not accrue time off), 401(k), life and disability insurance, recognition programs among other great benefits (all benefits are subject to eligibility requirements). For more information on our benefits, please visit this link.