Associate Director - IAM Advanced Authentication

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Job Purpose:

Every person, workload and AI agent at GSK needs an identity it can prove, credentials that cannot be stolen and access that is just enough, just in time. As our applications move to the cloud and AI agents begin working alongside our people, authentication is becoming the foundation of trust for everything we do. The Associate Director, leads the engineering and delivery of that foundation, starting with single sign-on (SSO) and extending the same discipline to Azure and Google Cloud (GCP), non-human identities (NHI) and AI agents.

Our vision:

One trusted way to authenticate, whoever or whatever is asking for access: passwordless for people, secretless for workloads and tightly scoped for AI agents. Security should be invisible when everything is right and decisive when it is not. We will get there by using AI securely in our own work, setting the example for the rest of GSK.

About the team:

Authentication and Cloud Security is part of Identity & Access Management. We build and run SSO for GSK’s workforce and applications, and bring the same discipline to securing the accounts, credentials and authentication of cloud, non-human and AI agent identities. Together with PKI & Cryptographic Services, we protect the identities, secrets and keys that GSK’s cloud and AI future depends on.

Key responsibilities:

In this role, you will turn that vision into reality. Your responsibilities will include:

• Build one team: Lead and develop a global team of engineers across SSO, cloud, NHI and AI agent identity, working as one team with shared patterns rather than separate product silos.

• Deliver the roadmap: Own the engineering roadmap, delivery plans and service measures, turning the agreed architecture and standards into reliable services.

• Make sign-in passwordless and trusted: Run GSK’s SSO services (SAML, OpenID Connect, OAuth 2.0), moving the workforce to passwordless, phishing-resistant authentication, with conditional access, strong identity verification for registration and account recovery, and the retirement of legacy authentication.

• Secure the cloud: Protect cloud accounts and access in Azure and GCP with strong authentication, workload identity federation, least privilege and just-in-time access, with no standing admin rights.

• Bring workloads and AI agents into the fold: Give non-human identities and AI agents unique, accountable identities kept separate from human ones, with protected credentials, scoped and revocable access and full audit logging, and promote integration with GSK’s identity lifecycle and governance processes.

• Move from secrets to secretless: Drive adoption of secrets vaulting and management, remove hard-coded credentials, favour short-lived and secretless authentication, and build secret scanning into engineering pipelines.

• Partner with PKI: Work with the PKI & Cryptographic Services lead to secure cloud, AI and secrets, with aligned roadmaps, clear ownership and a joined-up approach for stakeholders and auditors.

• Use AI ourselves: Apply AI to identity engineering and operations, such as risky sign-in analysis, anomaly detection, faster onboarding and incident triage, with human oversight and clear audit trails.

• Set the example: Show GSK what secure cloud and AI looks like through secure-by-default implementations, reusable patterns, automation and implementation guidelines.

• Keep trust earned: Ensure these services meet audit and compliance requirements, including GxP, SOX, ISO/IEC 27001, ISO/IEC 42001 and the EU AI Act, and lead major incidents and continual improvement with partner teams.

Basic Qualifications:

• Degree in computer science, information technology, cyber security or a related field, or equivalent experience.

• At least 10 years’ experience in identity or security, including leading engineering teams that deliver and run enterprise identity or security services in a large organisation.

• Strong knowledge of SSO and modern authentication (SAML, OpenID Connect, OAuth 2.0), conditional access, multi-factor authentication and passwordless authentication.

• Hands-on experience securing identity and access in Azure, including Microsoft Entra ID, Azure role-based access control and workload identities.

• Experience securing non-human identities and secrets, including vaulting, credential rotation and removing embedded secrets, and integrating them with identity lifecycle and governance processes.

• Working knowledge of AI and large language model security risks, such as agent permissions, data exposure and prompt injection.

• Strong leadership, delivery and communication skills, including managing roadmaps, suppliers and audits, and explaining technical risk to senior stakeholders.

Preferred Qualifications:

• Experience delivering SSO at scale with Microsoft Entra ID or Ping Identity, including passwordless authentication and identity verification.

• Experience securing identity and access in Google Cloud (GCP), and with tools for securing non-human identity credentials and cloud privileged access.

• Experience with secrets vaulting and management platforms such as Akeyless, CyberArk, HashiCorp Vault, Azure Key Vault or Google Secret Manager.

• Experience securing AI agents or platforms such as Azure AI Foundry, Vertex AI or Copilot, and familiarity with the NIST AI Risk Management Framework and the OWASP Top 10 for LLM Applications.

• Working understanding of PKI and certificate-based authentication, and experience with Terraform and identity automation.

• Certifications such as CISSP, CCSP, Microsoft Identity and Access Administrator, Azure Security Engineer or Google Professional Cloud Security Engineer.

• Experience in pharmaceuticals or another highly regulated industry.
• Typical tools and technologies: Microsoft Entra ID, Ping Identity, passkeys and FIDO2, Windows Hello for Business, Azure, Google Cloud, Akeyless, CyberArk, Azure Key Vault, Microsoft Graph, Terraform and CI/CD pipelines.

Skills

Account Lifecycle Management, Authentication Systems, Automation Technology, Certificate Management, Cloud Based Services, Computer Programming, Configuration Management (CM), Database Management, Directory Services, Enterprise IT, Equestrian Vaulting, Identity Access Management (IAM), Identity Lifecycle Management, Information Technology (IT) Risk Management, Infrastructure Security, Key Management, Privileged Access Management (PAM), Security Controls, Security Management Systems, Service Lifecycle Management, System Monitors, Troubleshooting

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases - to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at [email protected] to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK. The obtaining of prior written authorization is a condition precedent to any agreement (verbal or written) between the employment business/ agency and GSK. In the absence of such written authorization being obtained any actions undertaken by the employment business/agency shall be deemed to have been performed without the consent or contractual agreement of GSK. GSK shall therefore not be liable for any fees arising from such actions or any fees arising from any referrals by employment businesses/agencies in respect of the vacancies posted on this site.

It has come to our attention that the names of GlaxoSmithKline or GSK or our group companies are being used in connection with bogus job advertisements or through unsolicited emails asking candidates to make some payments for recruitment opportunities and interview. Please be advised that such advertisements and emails are not connected with the GlaxoSmithKline group in any way.

GlaxoSmithKline does not charge any fee whatsoever for recruitment process. Please do not make payments to any individuals / entities in connection with recruitment with any GlaxoSmithKline (or GSK) group company at any worldwide location. Even if they claim that the money is refundable.

If you come across unsolicited email from email addresses not ending in gsk.com or job advertisements which state that you should contact an email address that does not end in “gsk.com”, you should disregard the same and inform us by emailing [email protected], so that we can confirm to you if the job is genuine.