Associate Director, Information Security GRC

About the role

The Associate Director, Information Security Governance, Risk & Compliance leads the GRC function for Servier’s U.S. affiliate. Reporting to the Associate Director, Cybersecurity, this senior leader builds and scales a modern GRC capability aligned with global cybersecurity strategy and regulatory obligations.

Key responsibilities

• Establish and lead the U.S. information security risk management framework, including risk assessment methodologies, taxonomy, scoring models and reporting standards.
• Serve as the senior U.S. GRC leader, coordinating risk governance, policy lifecycle, control assurance and audit readiness across the affiliate.
• Define and monitor KPIs/KRIs for policy adoption, control maturity, security posture and remediation progress.
• Set strategic direction for third‑party security risk, integrating assessments into procurement, legal and business decision‑making.
• Partner with Global Information Security, IT, Legal, Privacy, Procurement, Quality and Internal Audit to ensure alignment with enterprise risk expectations.

Required profile

• 8+ years of experience in information security GRC, risk management or related disciplines.
• 3+ years in a leadership role with responsibility for program ownership and people management.
• Bachelor’s degree preferred in Cybersecurity, IT, Risk Management or a related field.
• Deep expertise in security frameworks such as NIST CSF 2.0, ISO 27001, PCI DSS, SOX and FAIR.

Required skills

• NIST Cybersecurity Framework (CSF) 2.0
• ISO/IEC 27001
• PCI DSS
• SOX compliance
• FAIR risk analysis
• CISSP certification
• CISM certification
• CRISC certification
• CISA certification
• CGRC certification