Associate Director, DDIT ISC Cyber Defense

About the role

Novartis is hiring an Associate Director for its DDIT ISC Cyber Defense function in Prague. The role supports the global ISC Country and Awareness program, focusing on country-specific information security requirements, cybersecurity regulatory compliance, information security advisory and security awareness. It also drives the practical adoption of AI and automation across ISC activities, including AI-assisted development and "vibe coding", while addressing security risks arising from AI use. The position is hybrid.

Key responsibilities

• Drive implementation and ongoing compliance with country-specific cybersecurity, privacy, AI and critical infrastructure regulations.
• Act as a trusted ISC advisor to business and DDIT stakeholders on security policies, controls and secure practices.
• Support cybersecurity audits, regulatory inspections and certifications, including evidence preparation and remediation.
• Manage country-level security risks, issues and incidents, working with SOC, threat detection, incident response and cyber defense teams.
• Design and deliver security awareness and training programs, including phishing simulations, targeted training and campaigns.
• Use security behavior data to identify risks and develop targeted awareness interventions.
• Partner across ISC, DDIT and business functions to coordinate regulatory, security and country-specific initiatives.
• Leverage AI, automation, low-code/no-code and AI-assisted development to streamline compliance, reporting and awareness.
• Assess AI-related security risks such as data exposure, access controls, prompt injection, insecure integrations, third-party risks and misuse.
• Monitor KPIs, emerging threats, regulations and technology trends and turn them into improved controls, SOC detection capabilities and security services.

Required profile

• 8+ years of experience in information security, with strong experience in security governance, regulatory compliance, risk management or advisory.
• Demonstrated experience implementing cybersecurity or technology regulatory requirements in a multinational environment, ideally including NIS2 or comparable regulations.
• Experience supporting security risk management, audits, regulatory assessments, inspections or compliance programs.
• Strong stakeholder management, communication and influencing skills, able to explain complex cybersecurity topics to technical and non-technical audiences.
• Desirable: experience in a large, global, highly regulated organization, preferably in pharmaceutical, healthcare or life sciences.

Required skills

• Knowledge of ISO/IEC 27001, NIST Cybersecurity Framework and related control frameworks.
• Hands-on experience with generative AI and AI coding assistants (e.g., GitHub Copilot, Microsoft Copilot, Power Platform).
• Working knowledge of SOC processes, including monitoring, alert triage, incident escalation and detection-rule lifecycle management.
• Desirable: security automation, SIEM or security analytics platforms, and tools such as Microsoft Sentinel, Microsoft Defender XDR and KQL.

What we offer

• Base salary range of 1,120,210 to 2,080,390 CZK, with a possible performance-based bonus.
• Benefits such as insurance plans, retirement plans and wellbeing resources.
• Flexible and hybrid working options where possible, and at least 14 weeks of paid parental leave.