{"id":2856835,"url":"https://alion.io/job/novartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3","title":"Head DDIT ISC Software Development Governance, Integrity & Secure Software Development Life Cycle (SDLC)","company":{"id":5824,"name":"Novartis","domain":"novartis.com","url":"https://alion.io/company/novartis","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":82,"open_postings":69,"ghost_share":0,"stale_share":0.71,"repost_share":0,"time_to_fill_p50_days":27,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Leadership","role_family":"Leadership","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hyderabad, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":35000,"max_usd":78000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":143},"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"21 CFR Part 11","optional":false},{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"IEC 62304","optional":false},{"name":"Platform Engineering","optional":false},{"name":"GDPR","optional":true},{"name":"Git","optional":true},{"name":"SBOM","optional":true}],"status":"live","first_seen_at":"2026-10-06T00:00:00Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-11-02T16:34:49Z","board_verified":true,"closed_at":null,"days_open":27,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":27},"description":"Job Description Summary\nWe build and buy software that touches clinical trials, patient safety, manufacturing, quality systems and commercial operations. It now ships weekly rather than yearly, is increasingly AI-assisted, and increasingly contains AI. Our control framework was built for a slower world.This role makes secure, compliant, audit-ready software delivery the fastest path for engineers - not a gate they route around. You will own the enterprise SDLC governance model and build much of it yourself: policy as code, automated evidence capture, pipeline controls and reference architectures.\nThis is a hands-on, individual-contributor leadership role. You will set enterprise direction, influence hundreds of engineers and lead through a federated community - but you will not have a large direct team, and you will spend meaningful time in repositories, pipelines and control code. Candidates seeking pure oversight or people management should not apply.\nJob Description\nKey Responsibilities:\nOwn the enterprise policy, standards and controls for software engineering, including source control, branching, peer review, testing, release management, environment segregation, change control, configuration and release documentation.\nRationalise overlapping GxP, SOX, privacy, security and IT-quality requirements into one coherent, risk-based framework, ensuring low-risk internal tools are not governed like regulated clinical systems.\nRetire SDLC controls that do not reduce risk and ensure tooling is implemented to securely speed up software development at Novartis at the highest scale, leveraging and creating AI tooling for the enterprise.\nImplement policy as code and controls as code, including branch protections, mandatory review, signed commits, segregation of duties, deployment approvals and immutable audit trails.\nBuild automated, continuous evidence pipelines and define control telemetry including coverage, exceptions, drift, mean time to remediate and control effectiveness, with a focus on agility, automation and speed.\nOwn secure-by-default guardrails in golden pipelines and paved-road platforms, aligning with recognized frameworks including NIST SSDF, ISO/IEC 27001 and IEC 62304 where applicable.\nDefine controls for AI-assisted engineering, including acceptable use of coding assistants, agentic tooling, IP and licence exposure, provenance, attribution and human accountability for review and approval.\nDefine controls for AI-containing products, including model lifecycle, dataset and model documentation, evaluation, drift monitoring, explainability, human oversight and readiness for evolving regulatory requirements.\nUse AI to reduce compliance burden through automated risk assessment drafting, control mapping, test generation, deviation triage and documentation synthesis, while serving as technical authority for inspections, audits, certifications and SDLC remediation.\nLead a federated community of engineering, quality, security and compliance practitioners, publish practical guidance, advise senior leaders on risk and trade-offs, and partner with software developers across the enterprise to enable efficient delivery of compliant and secure products.\nEssential Requirement:\nYou are a practitioner. You have substantial hands-on software engineering experience: you have written production code, owned CI/CD pipelines, and can read and modify pipeline configuration, IaC and policy code today, unaided. Expect a technical assessment.\n10+ years in software engineering, platform engineering, DevSecOps or engineering quality, including senior technical ownership of delivery pipelines at scale.\nExperience designing and operating automated controls in regulated environments - with evidence of replacing manual compliance work with software.\nWorking fluency in regulated-software requirements relevant to pharma/life sciences: GxP, GAMP 5 (2nd Ed.), CSA, 21 CFR Part 11, EU Annex 11 and data integrity/ALCOA+.\nSecurity engineering depth: application security, software supply chain security, secrets and identity management, vulnerability management.\nCredible technical judgement on AI in the SDLC - both the tooling and its governance implications.\nAbility to influence without authority across engineering, quality and business lines, and hold positions with senior stakeholders and auditors.\nExcellent written English.\nDesirable Requirement:\nExperience in pharma, biotech, medical devices or another regulated industry (finance, aviation, nuclear), with real inspection or audit exposure.Experience with SOX ITGC in engineering contexts, IEC 62304 / SaMD, and privacy-by-design under GDPR.\nHands-on with modern stacks: Git-based platforms and policy/protection features, container orchestration, cloud, IaC, policy engines (e.g. OPA/Rego or equivalent), test automation frameworks, SBOM and signing tooling.\nYou’ll receive: You can find everything you need to know about our benefits and rewards in the Novartis Life Handbook. https://www.novartis.com/careers/benefits-rewards\nCommitment to Diversity and Inclusion: \nNovartis is committed to building an outstanding, inclusive work environment and diverse teams' representative of the patients and communities we serve.\nJoin our Novartis Network: If this role is not suitable to your experience or career goals but you wish to stay connected to hear more about Novartis and our career opportunities, join the Novartis Network here: \nhttps://talentnetwork.novartis.com/network\nSkills Desired\nBusiness Acumen, Influencing Skills, Information Security Risk Management, IT Governance, Stakeholder Management, Strategic Leadership, Talent Development","description_format":"text","description_chars":5650,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["DevSecOps","Oncology Therapeutics","Neurology & CNS Therapeutics","Immunology & Inflammation Therapeutics"],"lifecycle":[{"event":"open","at":"2026-10-19T15:02:55Z"},{"event":"close","at":"2026-10-21T21:21:08Z"},{"event":"reopen","at":"2026-10-25T09:26:47Z"}],"visa":[],"liveness":{"score":36,"band":"fade","label":"Fading","p_open":1,"p_active":0.654,"p_room":0.55,"age_days":27,"expected_fill_days":27,"reasons":["conf:4","stale_co","wave","velocity","win:tail","comp:brand"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/novartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3","json_url":"https://alion.io/job/novartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3.json","meta":{"generated_at":"2026-11-02T19:35:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27494,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5824},"rest":"https://alion.io/mcp/rest/get_company?id=5824"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnovartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnovartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnovartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/novartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnovartis-head-ddit-isc-software-development-governance-integrity-secure-software-development-life-cycle-sdlc-3"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2856835}},{"tool":"search_jobs","arguments":{"company":"novartis.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2856835},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}