Our client is seeking a hands-on Group IT Security Manager to improve information and cybersecurity across a pharmaceutical group and its manufacturing-related IT environments. You will combine technical delivery, risk management and incident response with functional guidance of the Security Operations Analyst.

Your responsibilities:

Develop a practical security roadmap, programme, standards and delivery plans. Maintain the risk register, assess business changes and escalate significant exposures, resource constraints and risk exceptions.
Lead independent security testing; assign findings to owners with target dates, verify remediation evidence and independent retesting, and address recurring weaknesses.
Strengthen identity and privileged access, including joiner/mover/leaver controls, reviews, administrator and service accounts, supplier and emergency access. Secure credentials and establish authorised backup coverage.
Improve Microsoft 365, cloud, endpoint and on-premises security, including email protection, logging, vulnerability management, secure configuration, patching and data-loss prevention with the responsible owners.
Improve IT/OT separation, supplier remote access and legacy-system controls. Coordinate approved changes and testing with site teams and QA to protect production availability, data integrity and validated systems.
Establish monitoring and escalation arrangements, lead complex incident investigations, coordinate containment and recovery, preserve evidence and follow up corrective actions.
Contribute to cyber resilience through backup protection, recovery access, restoration procedures, incident exercises and recovery tests; keep security procedures current and available to authorised deputies.
Manage security suppliers and verify deliverables. Assess new applications, cloud services and AI-enabled tools with IT, business owners, Legal and QA without assuming business or GxP AI-governance ownership.
Maintain practical policies, standards and awareness training; support compliance, audit and inspection evidence and controlled implementation.
Report material risks, incidents, remediation and control effectiveness, including quarterly leadership reviews. Present investment options and develop the analyst and wider IT team's security capability.

Your profile:

At least seven years of relevant security experience, including ownership of delivered improvements and complex technical issues.
Practical expertise in Microsoft 365, cloud and on-premises security, identity and privileged access, endpoint protection, vulnerability management and logging.
Experience securing manufacturing-critical or comparable regulated production environments, with awareness of GxP, data integrity and validated systems. Pharmaceutical or biotechnology experience is strongly preferred.
A relevant degree or equivalent practical experience. CISSP or comparable certification and knowledge of ISO 27001, IEC 62443 and the Purdue Model are advantageous.
English and German at B2–C1 level are required.

What to expect:

Based in Fischamend, with regular on-site attendance and one day of home office per week; group travel as required.
Functional leadership of the analyst. System owners retain operational responsibility, and QA retains GxP validation decisions.
Out-of-hours participation and on-call arrangements must be agreed explicitly. This role alone is not a 24/7 monitoring or response service.