Manager, Business Information Security Office​

Our Global Cybersecurity Governance, Risk, and Compliance (GRC) team provides comprehensive blueprints for cybersecurity excellence by embedding governance, risk management, and compliance into every layer. The team is responsible for ensuring risk-based decision-making is used, and that security, privacy, and regulatory compliance is integrated seamlessly with Pfizer’s organization.

We are seeking an experienced Manager, Business Information Security Office (BISO) to serve as a trusted cybersecurity advisor and liaison between the Cybersecurity organization and business stakeholders. This role will support the integration of cybersecurity requirements into business initiatives, technology programs, and risk decisions while helping ensure alignment with enterprise policies, standards, regulatory expectations, and industry best practices.

ROLE RESPONSIBILITIES

• Serve as a primary cybersecurity point of contact for assigned business functions, providing guidance on cyber risk, policy requirements, and control expectations.

• Partner with business, digital, product, quality, privacy, legal, and compliance stakeholders to embed cybersecurity into business processes, technology initiatives, and transformation programs.


• Support the identification, assessment, and communication of cybersecurity risks impacting business operations, critical assets, data, and third-party relationships.


• Facilitate cybersecurity engagement across key business initiatives, including solution profiling, risk assessments, control applicability, and remediation planning.


• Translate cybersecurity policies, standards, and regulatory requirements into practical business guidance and actionable requirements.


• Monitor and report on cybersecurity risk posture, compliance status, open issues, exceptions, and remediation progress for assigned business areas.


• Coordinate with Cyber GRC, security architecture, privacy, third-party risk, incident response, and technology teams to ensure consistent risk management practices.


• Support business readiness for audits, inspections, regulatory inquiries, and internal assessments by coordinating responses and evidence collection.


• Advise business stakeholders on cybersecurity implications related to new technologies, process changes, data use, cloud adoption, and vendor engagements.


• Drive awareness and adoption of cybersecurity requirements, including data protection, access management, secure technology use, and risk acceptance processes.


• Identify recurring control gaps, risk themes, and process improvement opportunities across business functions.


• Prepare executive-ready reporting, metrics, dashboards, and briefing materials for business leadership and cyber governance forums.


• Contribute to the ongoing enhancement of the BISO operating model, engagement processes, governance routines, and stakeholder communications.


• Promote a risk-based, business-aligned cybersecurity culture that enables innovation while protecting company assets, regulated data, and critical operations.

BASIC QUALIFICATIONS

• Bachelor’s degree in Cybersecurity, Information Technology, Risk Management, Business, or a related field.


• 4+ years of experience in cybersecurity, technology risk, information security, IT governance, compliance, or related disciplines.


• Experience partnering with business stakeholders to assess cyber risk, communicate requirements, and support remediation activities.


• Strong understanding of cybersecurity frameworks, policies, and controls, such as NIST CSF, ISO 27001, CIS Controls, or related industry standards.


• Ability to translate complex technical and risk concepts into clear, business-relevant messaging.


• Strong stakeholder management, communication, facilitation, and influencing skills.


• Experience with GRC platforms, risk registers, control assessment processes, audit support, or exception management is preferred.


• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.

PREFERRED QUALIFICATIONS

• Relevant professional certifications (e.g., CISSP, CISA, CRISC, CISM, or similar) preferred


• Familiarity with regulatory and compliance expectations in a highly regulated environment; pharmaceutical, healthcare, life sciences, or GxP experience is a plus.


• Business-minded cybersecurity professional with a practical, risk-based approach.


• Strong relationship builder who can operate effectively across technical, business, and executive audiences.


• Comfortable working in a matrixed, global, and regulated environment.


• Detail-oriented with strong follow-through, documentation, and issue management skills.


• Proactive, collaborative, and able to balance risk management with business enablement.

NON-STANDARD WORK SCHEDULE, TRAVEL OR ENVIRONMENT REQUIREMENTS

• Travel as required by the business (less than 20% domestic and/or international)


• Work Location Assignment: Must be able to work in assigned Pfizer office 2-3 days per week, or as needed by the business

Work Location Assignment: Hybrid

• Please apply by sending your CV and a motivational letter in English