Senior Principal – Design Assurance & Product Management

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.

Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.

Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.

Domain focus: Security products for Network & Zero Trust and MDR & Detection Engineering.

Job Purpose:

Own security product management for Network, Zero Trust and MDR: the product lifecycle, roadmap, adoption and outcomes for the tooling in these domains. You define requirements with the architecture domains, manage vendor delivery, and own the investment case and total cost position.

About the team:

Design Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects. Design Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything. Product Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.

What makes this role different. Zero Trust at GSK is being built from the ground up, so you are not optimising a mature product set — you are sequencing a migration off an estate people are comfortable with, against application owners who will tell you their system cannot tolerate segmentation. You own the product, the roadmap and the investment; Network and Zero Trust Architecture owns the design standards and you do not. You are measured on enforcement coverage and detection quality in production, not on whether tooling was delivered.

Key responsibilities:

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

• Own the product lifecycle and roadmap for Network, Zero Trust and MDR security tooling.
• Define product requirements with the architecture domains and track them through build to release.
• Own adoption as an enforcement figure — the share of application access brokered through Zscaler or Prisma Access rather than legacy VPN, and the share of the estate under Illumio microsegmentation policy — and act when migration stalls behind an application owner's objection.
• Manage Zscaler, Netskope, Illumio and the MDR provider against delivery and detection-quality commitments, including mean time to deploy new detection content and false-positive rates on tuned rules.
• Own the investment case and total cost of ownership position.
• Run the product governance forum and keep decisions traceable.
• Assess new network, ZT and detection tooling on commercial and lifecycle grounds — licence model, data egress cost, operability by the managed service — while Network and Zero Trust Architecture assesses technical fit.
• Land the consolidation of overlapping remote-access and proxy estates — legacy VPN concentrators, standalone secure web gateways and point CASB tools — into the SASE platform, on a dated retirement schedule.
• Act as the escalation point for the SOC and the network engineering teams when a detection gap or an enforcement-point outage is attributed to the product rather than the service.
• Drive the roadmap from identity-based intrusion and lateral movement: adversaries authenticating with valid credentials and moving east-west inside flat segments, which is why segmentation coverage and brokered-access share are the metrics this portfolio is judged on, not licences deployed.
• Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK's Responsible AI, privacy and security requirements.
• Apply GxP, GDPR and data integrity requirements to the tooling in scope, so a routine product change cannot disturb a validated system or the records it holds.
• Coach domain analysts and peers in product management practice.

Basic Qualifications:

• 15+ years in cyber security in a regulated environment — domain focus: security products for Network & Zero Trust and MDR & Detection Engineering
• End-to-end product ownership of Network & Zero Trust and MDR & Detection Engineering tools — translating threat intelligence and CISO requirements into funded use cases, with 1-3 year roadmaps for investment, consolidation and retirement and published adoption metrics
• Vendor evaluation, selection and lifecycle management — value tracked against threat and risk coverage with automated performance reporting, driving decommission where value is not evidenced
• Working in parallel with the Security Solution Engineering squad for Network & Zero Trust and MDR & Detection Engineering — aligning use cases and roadmaps to build, test and vendor handover plans, and coordinating with architecture and Design Assurance without owning standards
• Evaluating AI-enabled network and detection products — AI-driven detection, GenAI SOC copilots and agentic SOAR — and their vendor AI claims

Preferred Qualifications:

• Technical familiarity with Zero Trust enforcement points, segmentation, SASE and SD-WAN, secure remote access, SIEM, SOAR, EDR/XDR and MDR tooling
• Product management discipline — roadmaps, adoption and coverage metrics, and decommission business cases
• Vendor governance rhythm — QBRs, executive business reviews, SLA management and commercial negotiation input to Procurement
• Portfolio analytics, licence utilisation and renewal calendar management, with tracking and alerts automated through dashboards
• Product management certification (Pragmatic Institute, SAFe POPM or equivalent) or CISSP
• Qualifications: Bachelor's degree in a relevant discipline, or equivalent professional experience.
• Typical tools and technologies: Product roadmapping and adoption metrics, Network and Zero Trust tooling landscape including Zscaler, Netskope, Illumio and Prisma Access, MDR and detection tooling including Splunk, Microsoft Sentinel and Crowd Strike, vendor evaluation and proof-of-value, threat intelligence inputs to use-case definition, ServiceNow, Power BI.

#AG Tech

Skills

Accenture Managed Detection and Response (MDR) Ops Security Engineering, AI for Cybersecurity, Application Security, Cloud Security, Computer Programming, Data Security, Identity Access Management (IAM), Information Systems, Infrastructure Security, MD5, ML Security, Operating Systems Security, Product Security, Scripting, Security Engineering, Security Technologies, Security Testing, Vulnerability Management, Zero Trust, Zero Trust Architecture

Why GSK?

Uniting science, technology and talent to get ahead of disease together.

GSK is a global biopharma company with a purpose to unite science, technology and talent to get ahead of disease together. We aim to positively impact the health of 2.5 billion people by the end of the decade, as a successful, growing company where people can thrive. We get ahead of disease by preventing and treating it with innovation in specialty medicines and vaccines. We focus on four therapeutic areas: respiratory, immunology and inflammation; oncology; HIV; and infectious diseases – to impact health at scale.

People and patients around the world count on the medicines and vaccines we make, so we’re committed to creating an environment where our people can thrive and focus on what matters most. Our culture of being ambitious for patients, accountable for impact and doing the right thing is the foundation for how, together, we deliver for patients, shareholders and our people.

Inclusion at GSK:

As an employer committed to Inclusion, we encourage you to reach out if you need any adjustments during the recruitment process.

Please contact our Recruitment Team at [contact removed] to discuss your needs.

Important notice to Employment businesses/ Agencies

GSK does not accept referrals from employment businesses and/or employment agencies in respect of the vacancies posted on this site. All employment businesses/agencies are required to contact GSK's commercial and general procurement/human resources department to obtain prior written authorization before referring any candidates to GSK.