Head DDIT ISC Software Development Governance & Secure SDLC

About the role

Novartis is looking for a Head of Software Development Governance, Integrity and Secure Software Development Life Cycle (SDLC) in Prague. The role owns the enterprise SDLC governance model, including policy as code, automated evidence capture, pipeline controls and reference architectures. It is a hands-on, individual-contributor leadership position: you set enterprise direction and influence hundreds of engineers, but you will not have a large direct team and will spend meaningful time in repositories, pipelines and control code.

Key responsibilities

• Own the enterprise policy, standards and controls for software engineering, covering source control, branching, peer review, testing, release management, environment segregation, change control and documentation.
• Rationalise overlapping GxP, SOX, privacy, security and IT-quality requirements into one risk-based framework, so low-risk internal tools are not governed like regulated clinical systems.
• Retire SDLC controls that do not reduce risk and implement tooling that speeds up development securely, using and creating AI tooling for the enterprise.
• Implement policy as code and controls as code, including branch protections, mandatory review, signed commits, segregation of duties, deployment approvals and immutable audit trails.
• Build automated, continuous evidence pipelines and control telemetry (coverage, exceptions, drift, mean time to remediate).
• Define guardrails for AI-assisted engineering and AI-containing products, including acceptable use, provenance, model lifecycle, evaluation and drift monitoring.
• Use AI to reduce compliance burden (risk assessment drafting, control mapping, test generation, documentation synthesis) and act as technical authority for inspections, audits and remediation.
• Lead a federated community of engineering, quality, security and compliance practitioners and advise senior leaders on risk and trade-offs.

Required profile

• Substantial hands-on software engineering experience: writing production code, owning CI/CD pipelines, reading and modifying pipeline configuration, IaC and policy code.
• 10+ years in software engineering, platform engineering, DevSecOps or engineering quality, with senior technical ownership of delivery pipelines at scale.
• Experience designing automated controls in regulated environments, replacing manual compliance work with software.
• Fluent knowledge of GxP, GAMP 5 (2nd Ed.), CSA, 21 CFR Part 11, EU Annex 11 and ALCOA+ data integrity.
• Security depth in application security, software supply chain, secrets and identity management, vulnerability management.
• Credible judgement on AI in the SDLC and ability to influence without authority across engineering, quality and business lines.
• Excellent written English.

Desirable requirements

• Pharma, biotech, medical devices or other regulated industry experience, with inspection or audit exposure.
• SOX ITGC, IEC 62304 / SaMD, privacy-by-design under GDPR.
• Git, container orchestration, cloud, IaC, policy engines (OPA/Rego), test automation, SBOM and signing tooling.

What we offer

• Base salary range of 2,292,080 to 4,256,720 CZK, with a possible performance-based bonus.
• Insurance plans, retirement plans, wellbeing resources and global recognition programs.
• Flexible and hybrid working where possible, and at least 14 weeks of paid parental leave.