Director, Proactive Defense Operations

Business Introduction

GSK remains committed to achieving bold commercial ambitions for the future. By 2031, we aim to deliver £40 billion in annual sales, leveraging our existing strong performance momentum to significantly increase our positive impact on the health of billions of patients globally. Our Ahead Together strategy is centred on early intervention to prevent and alter the course of disease, thereby protecting people and supporting healthcare systems.
Our diverse portfolio consists of vaccines, specialty medicines, and general medicines.
Through continuous innovation and a dedicated focus on scientific and technical excellence, we strive to develop and launch new, groundbreaking treatments that address critical health challenges.


Position Summary

The Director, Proactive Defense Operations will own the Proactive Defense Operations (PDO) capability end to end, including its strategy, delivery and performance. This is a leadership role accountable for converting global adversary threat data into validated, automated defensive action at machine speed, and for the team that delivers it.

About the team

Proactive Defense Operations (PDO) moves GSK from an intelligence-and-reporting model to an automation- and engineering-centric capability. The team converts global threat data into immediate, validated operational actions, interrogating internal telemetry, triggering automated defenses and equipping defenders with contextualized, high-fidelity blueprints. PDO is organized into two operational pillars, Intelligence Automation and Threat & Context Analysis, and functions as the proactive defensive engine of Cyber Defense, working closely with Detection Engineering, SecOps/Incident Response and Vulnerability Management. Join us as a leader in shaping the future of cybersecurity at GSK. In this role, you will lead the Predictive Security Operations team to anticipate and respond to evolving cyber threats. You will work closely with diverse teams across the organization, helping us stay ahead of risks that could impact our mission. We seek someone curious, collaborative, and committed to continuous learning. Here, your work will have a meaningful impact, helping protect our people, data, and technologies as we unite science, technology, and talent to get ahead of disease together.

Responsibilities

This role will provide YOU the opportunity to lead key activities to progress YOUR career. These responsibilities include some of the following:

• Own the Proactive Defense Operations capability end to end, including roadmap, delivery and service performance.
• Lead and develop the team, setting priorities and managing performance across both operational pillars.

• Own the capability budget and supplier and vendor relationships.

• Report capability performance and risk to CSO leadership and governance forums.

• Own the enterprise Priority Intelligence Requirements (PIR) framework, calibrating threat collection and automated triage to actual corporate risk.

• Direct machine-speed exposure triage and escalation, setting SLAs from threat identification to validated IR escalation or Proactive Operational Pack (POP) delivery.

• Govern the PDO technology stack (SIEM, security data lake, SOAR, Threat Intelligence Platform) and approve automation pipeline and API integration architecture.

• Own the RASCI interfaces with Detection Engineering, SecOps/IR and Vulnerability Management, ensuring PDO outputs are consumed rapidly and without rework.

• Build and maintain the metrics that show whether the Cyber Defense function is getting ahead of threat activity.
• Lead your team in using approved AI tools to improve productivity and ways of working, role-modelling responsible use and follow GSK’s Responsible AI, privacy and security requirements.

Why You?

Basic Qualification

We are seeking professionals with the following required skills and qualifications to help us achieve our goals:

• Bachelor’s degree in cybersecurity, computer science, information technology, or a related discipline, or equivalent related experience.
• 12+ years of cyber security experience.

• Experience in security operations, detection engineering, or security data science.

• Experience with SIEM/SOAR platforms, telemetry pipelines, and detection rule frameworks such as YARA-L or Sigma.

• Experience with end-to-end ownership of a cyber security capability.

• Leadership or people management experience with technical or specialist teams.

• Experience managing budgets, suppliers, and delivery commitments.

Preferred Qualification

If you have the following characteristics, it would be a plus:

• CISSP, CISM or equivalent senior security certification.

• Expert-level proficiency in MITRE ATT&CK and Cyber Kill Chain operationalization.

• Experience engineering or governing low-code/no-code automation at enterprise scale.

• Experience leading teams that operationalize intelligence into automated defensive action

…