At Roche you can show up as yourself, embraced for the unique qualities you bring. As the IT Security Risk & Audit Specialist, you will move beyond standard checklists to manage and coordinate the end-to-end security risk lifecycle. You will bridge the gap between technical security engineering and executive risk posture, assuring our general systems and third-party ecosystems remain resilient against an evolving threat landscape.

Risk Assessment: Support comprehensive security risk assessments and audits using frameworks like NIST CSF and ISO 27001 to identify vulnerabilities in systems, cloud services, and emerging technologies Third-Party Cyber Risk Management: Execute security, privacy and quality evaluations of global vendors, focusing on supply chain integrity, data sovereignty, and breach notification capabilities.

Audit Assurance: Support internal and external security audits and provide guidance on remediation findings Continuous Compliance Monitoring: Design and implement automated tools to monitor the effectiveness of security controls in real-time, moving the organization toward data-driven monitoring.

OT & Manufacturing Protection: Support the evaluation of the security posture of Manufacturing and Operational Technology (OT) environments to ensure high availability and protection against industrial cyber threats Bachelor’s degree in Cybersecurity, Computer Science,



or a related technical field (Master’s preferred) Professional Experience: 3+ years in a dedicated Security Risk or Audit or Compliance role within a global enterprise, specifically handling Hybrid-Cloud and OT/IoT environments Knowledge of security standards (ISO 27001, NIST CSF), data protection and privacy regulations such as GDPR or HIPAA Familiar with health authority regulations, systems financial controls, software development lifecycle, computer systems validation, infrastructure qualification, and ITIL processes Audit & Control Automation: Experience in translating manual security controls into automated, data-driven monitoring requirements (Continuous Controls Monitoring, ITGC) Analytical & Project Management: Strong ability to support complex assessments and drive the optimization of risk monitoring tools Together, more than 100,000 employees across the globe are dedicated to advance science, ensuring everyone has access to healthcare today and for generations to come. Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.

📌 Security Risk and Audit Specialist - RDT Information Security (Madrid)
🏢 Roche
📍 Madrid