Senior Director, Chief Information Security Officer

Location: Princeton or Rockville Employment Type: Full Time

About Us

Otsuka is a global healthcare company driven by the corporate philosophy: "Otsuka people creating new products for better health worldwide." We are committed to researching, developing, manufacturing, and marketing innovative products, with a strong focus on pharmaceutical treatments for diseases and nutraceutical products to maintain everyday health. Our pharmaceutical efforts emphasize developing and commercializing therapies in Neuroscience, Nephrology, and Immunology, along with research programs targeting various unmet specialty disease areas.

Job Description

The Senior Director, Chief Information Security Officer (CISO), will lead the development, implementation and management of Otsuka America Pharmaceutical, Inc.’s (OAPI’s) and Otsuka Pharmaceutical Development and Commercialization, Inc.’s (OPDC’s) cybersecurity risk management framework.

Reporting directly to the Vice President & US Chief Compliance Officer (CCO), the CISO will bolster Otsuka's Second Line of Defense by identifying and mitigating potential cybersecurity risks, ensuring regulatory compliance, and driving a culture of proactive security awareness.  The successful leader in this role is a consummate learner and teacher who can understand an increasingly complex landscape and translate learnings into concrete solutions and actions needed to protect the organization.

Key Responsibilities

• Strategic Leadership and Risk Management
• Advance and implement a comprehensive cybersecurity risk management framework for OAPI and OPDC, to proactively identify, evaluate, and mitigate potential risks. 
• Continuously assess:
• the strength and effectiveness of the OAPI and OPDC cybersecurity risk management framework, and where necessary, implement CCO-endorsed framework enhancements; and
• the skills and capabilities needed for the present and future operational excellence of the Information Security team.

• Survey and summarize changes or trends in cybersecurity laws, regulations, and accreditation standards (including, but not limited to, those directly impacting the healthcare industry), providing frequent and succinct updates to the CCO and, where applicable, proactively proposing cybersecurity risk framework enhancements to mitigate risk to the organization.
• Work closely with the Vice President & Chief Information Officer (CIO) and the CIO’s leadership team to ensure cross-functional alignment and consistency with broader IT business objectives and activities.
• Provide cybersecurity advice, guidance, and support to other Otsuka companies as needed, including ex-US affiliates.

Policy, Standards, and Control Framework

• Develop, implement, and enforce enterprise-wide security policies, standards, and frameworks to ensure compliance with regulatory requirements (e.g., HIPAA, GDPR, FDA, ISO 27001).
• Collaborate with regulatory bodies during audits, compliance reviews, and investigations, ensuring transparency and alignment with legal requirements. 
• Support data privacy and protection efforts, helping to imbed privacy principles into information security practices and processes.

Security Operations and Capabilities

• Lead the Security Operations Center (SOC) and continuously monitor, detect, and respond to potential security incidents.
• Directly supervise the OAPI and OPDC Information Security team (a component of US Ethics & Compliance) with management responsibility for at least five FTE reports.
• Oversee and optimize critical security functions, including, but not limited to:
• Vulnerability Management
• Application Security
• Network Security
• Security Information and Event Management (SIEM)
• Data Loss Prevention (DLP)
• Develop and implement robust incident response plans, including penetration testing and CCO-approved cyber investigations and forensic analyses.
• Ensure continuous improvement of organizational threat detection, response, and remediation capabilities through advanced technologies (including AI-driven tools and platforms) and best practices.

Education and Awareness

• Develop and provide cybersecurity training and awareness programs for OAPI and OPDC employees.
• Clearly articulate cybersecurity risks, strategies, and initiatives to technical and non-technical audiences at all levels of the organization.
• Promote organization-wide adoption of security best practices in partnership with IT and the business. 

Qualifications

• Master’s degree in Information Management, Cybersecurity, Computer Science, or a related field.
• Certific