Sr. Security Compliance Analyst

About Astellas

Astellas is a global life sciences company committed to turning innovative science into VALUE for patients. We provide transformative therapies in disease areas that include oncology, ophthalmology, urology, immunology and women's health. Through our research and development programs, we are pioneering new healthcare solutions for diseases with high unmet medical need. Learn more at Astellas.com.

Are you driven to make a real difference in the lives of patients?

We're seeking passionate individuals who thrive in dynamic environments, embrace new ideas, and aren't afraid to take intelligent risks. People who act with unwavering integrity and are deeply committed to making a tangible impact.

Purpose and Scope:

Help a global pharmaceutical company adopt new technology, including AI, safely. As Sr. Security Compliance Analyst, you will make sure the systems Astellas buys, builds and runs are secure from the start: setting clear security requirements, confirming they are met before go-live, and monitoring them once systems are in use. You will work with project teams, vendors and quality colleagues across the US, Europe, Japan and India, and help shape how Astellas secures emerging technology such as AI.

Responsibilities and Accountabilities:

Scope: Third-party and cloud (SaaS) solutions, in-house built applications and AI systems (models, agents, copilots), for both GxP (FDA/EU-regulated) and non-regulated use.

• Plan & Design: Join new projects early to identify security and compliance risks; assess vendors and cloud services before contracts are signed (e.g., SOC 2 reports, ISO 27001 certifications, security questionnaires); make sure contracts include the right security terms; and assess risks in new AI tools with our AI Security team.
• Requirements & Standards: Own the security requirements in Astellas' System Life Cycle (SLC), our process for delivering and validating systems, keeping them clear, testable and tied to policy and regulation (e.g., 21 CFR Part 11, EU Annex 11); keep security standards current as policies, threats and technologies such as AI evolve; and tailor requirements to each system's type and risk.
• Build & Change: Review specifications, designs and test evidence to confirm security requirements are met before go-live and with every change; provide the security sign-off at key project checkpoints and in change control; and drive gaps to resolution or manage formal, time-limited exceptions.
• Operate & Monitor: Run periodic reviews of live systems and reassess key vendors; track open risks and exceptions through to closure; maintain the technology risk register and report on risk to leadership; run and improve risk and vendor-risk workflows in OneTrust; and, when systems or vendor relationships end, confirm access is removed and data is returned or destroyed.
• Partnership & Governance: Act as Cybersecurity's partner to our IT quality and compliance team, keeping security and quality requirements aligned and free of duplication, including for AI systems; guide and train system owners, project teams and vendors; support audits and assessments with evidence; and work with procurement, legal and quality colleagues across regions.

Required Qualification:

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related field.
• 5+ years in cybersecurity compliance, IT risk or third-party risk management.
• Hands-on experience defining or reviewing security requirements for systems throughout their life cycle.
• Hands-on experience assessing the security of vendors and cloud services.
• Working knowledge of common security frameworks such as NIST CSF, NIST SP 800-53 and ISO 27001.
• Strong written English and the ability to explain findings clearly to technical and business audiences across time zones.

Preferred Qualifications:

• Experience in a GxP-regulated environment (computer system validation, 21 CFR Part 11, EU Annex 11, GAMP 5), including validation documents such as user requirements, specifications and traceability matrices.
• Experience with OneTrust (IT and third-party risk modules), ALM (requirements management) or Veeva Vault.
• Exposure to AI risk assessment and cloud/SaaS security.
• Knowledge of secure development (NIST SSDF) and supply chain risk (NIST SP 800-161) guidance.
• Certifications such as CRISC, CISA, CISM, CISSP, CCSP or CTPRP.

Working Environment:

At Astellas we recognize the importance of work/life balance, and we are proud to offer a hybrid working solution allowing time to connect with colleagues at the office with the flexibility to also work from home. We believe this will optimize the most productive work environment for all employees to succeed and deliver. Hybrid work from certain locations may be permitted in accordance with Astellas’ Responsible Flexibility