At Roche you can show up as yourself, embraced for the unique qualities you bring.

Position Position

OverviewThe Cybersecurity & Privacy Risk Manager leads the development, execution, and continuous optimization of a robust, unified cybersecurity and privacy risk management framework across the enterprise. Operating globally within a Scaled Agile Framework (SAFe) environment, this role ensures that technology, digital healthcare solutions, and information assets remain secure, compliant, and resilient against evolving threats. By translating risk data into strategic actionable insights, the Risk Manager enables key decision-makers—from tactical Business Risk Owners to Senior Executive Leadership—to make informed, proactive decisions regarding risk tolerance, investment priorities, and governance.Drive comprehensive risk assessments across global business operations and product groups, identifying potential cybersecurity and privacy vulnerabilities, operational risks, and regulatory exposures.Formulate quantitative and qualitative risk reports and dashboards tailored for both operational Risk Owners and Senior Management decision-makers, establishing clear exposure visibility and strategic mitigation paths.Define, monitor, and enforce risk tolerance thresholds aligned with overall business goals and regulatory mandates (GDPR, HIPAA, ISO standards).

Thought Leadership &

• Remediation Advisory: Provide expert consultative guidance on remediation strategies, risk treatment plans, and process improvements, demonstrating ROI on risk mitigation investments.Cross-Functional &

• Global Collaboration: Partner closely with global Security, Privacy, Legal, Quality &

• Regulatory, and Business units to embed security-by-design and privacy-by-design principles throughout the organizational lifecycle.Requirements &





• ExperienceEducation: Bachelor's degree in Computer Science, Information Security, Business Information Systems, or a related field (Master's degree preferred).

Experience: 6+ years of experience in cybersecurity, privacy risk management, compliance, or information security governance within large-scale, multinational environments.Agile & Framework Expertise: Demonstrated experience operating within Scaled Agile (SAFe) and Agile frameworks, managing risks across matrixed development teams and governance levels.Compliance & Regulatory Knowledge: Deep familiarity with integral privacy regulations (GDPR, HIPAA) and cybersecurity standards (ISO *, NIST, CIS). Proven ability to engage, challenge, and influence decision-makers at both operational risk-owner levels and Senior Management forums.Prior experience in healthcare, medical diagnostics, pharmaceuticals, or regulated digital software environments is strongly preferred.Strong data analytical capabilities with the ability to build risk models and present metric-driven strategies.Exemplary "Zoom Out / Zoom In" capability—able to define overarching global strategies while diving into granular technical risk scenarios when communicating with subject matter experts.Our efforts result in more than 26 million people treated with our medicines and over 30 billion tests conducted using our Diagnostics products. We empower each other to explore new possibilities, foster creativity, and keep our ambitions high, so we can deliver life-changing healthcare solutions that make a global impact.

We believe it's urgent to deliver medical solutions right now – even as we develop innovations for the future. And we believe that good business means a better world. We are many, working as one across functions, across companies, and across the world.

📌 Cybersecurity & Privacy Risk And Compliance Manager (Barcelona)
🏢 Roche
📍 Barcelona