Responsibilities

Coordinate and manage product security and privacy compliance activities.

Author new or updated policies and procedures for internal partner and stakeholder input.

Create and maintain security and privacy‑related documentation in response to legal and regulatory requirements (e.g., HIPAA, GDPR, etc.) and manage related intranet repositories.

Prepare and deliver communication and training to educate Roche teams on the evolving compliance landscape and on new or updated policies.

Support Roche Sales, product teams and IT groups, legal and other parties to address customer questions and needs regarding Roche products, ensuring customer confidence in data security (e.g., by reviewing contract templates, contributing security and privacy language, and supporting completion of customer security questionnaires).

Escalate vigente or potential compliance violations or other issues to relevant colleagues or management according to local, regional and/or global policies and procedures.

Manage and perform activities related to preparation, execution and remediation of internal and external compliance audits.

Maintain IT internal controls to ensure they are designed and operate effectively to meet compliance requirements for in‑scope applications.

Establish and promote a business‑compliance implementation process, ensuring risk convergence and privacy protection technology for business scenarios.

Understand cybersecurity concepts and communicate them to non‑security audiences.

Review key processing activities, data protection impact assessments (DPIAs), data processing agreements, data retention and deletion approaches, and training records.

Minimum Qualifications

Bachelor’s degree in a field with a strong emphasis on information security, computer, communication, or related majors; a master’s degree is a plus.

1+ year(s) of cybersecurity and/or privacy program management experience,



and exposure to large‑scale systems in a fast‑paced environment.

Audit and/or compliance experience in multinational environments.

Experience using data and metrics to define business strategy and gain executive support for new visions.

Preferably related experience in healthcare, diagnostics and/or pharmaceutical industry.

Knowledge of HIPAA, GDPR and other privacy‑relevant legislation and regulations.

Excellent verbal and written communication & data presentation skills, and proven ability to communicate with both business and technical teams.

Ability to work in and with globally distributed and multi‑cultural teams.

Best‑in‑class attitude: challenge the status quo constructively, be results‑oriented, influence others, and adopt a solution‑oriented mindset.

Preferred Qualifications

Experience working in a software development environment.

Valuable certifications such as ISO27001 Lead Auditor, CISA, CISM, CISSP, GIAC, OSCP, SSCP or equivalent.

Proven ability to influence change at all levels within an organization.

Expert planner with business process definition experience and strong IT aptitude.

Knowledge of Product Development Life Cycles (PDLC).

Working knowledge or willingness to quickly learn the content and requirements of various laws, regulations, industry guidance and company compliance policies, particularly related to privacy, data disclosure and cybersecurity.

Demonstrated data‑analytical skills, creativity and experience working with attention to detail.

Experience maintaining open, candid and trusting work relationships.

Capable of “zooming out” to see the big picture and give strategic direction, and of “zooming in” to provide granular guidance when engaging with a wide range of experts.

Strong business acumen, sensitivity to business needs, viewing change as an opportunity, and eagerness to work in a fast‑paced environment.

Strong organizational skills and ability to prioritize and manage multiple simultaneous projects.

Roche is an Equal Opportunity Employer.

📌 Cyber Security Compliance Intern (Madrid)
🏢 F. Hoffmann-La Roche
📍 Madrid