Sr. Manager, Business Information Security Office

Use Your Power for Purpose

Technology impacts everything we do. Pfizer’s digital and ‘data first’ strategy focuses on implementing impactful and innovative technology solutions across all functions from research to manufacturing. Whether you are digitizing drug discovery and development, identifying solutions, or making our work easier and faster, you will be making a difference to countless lives.

ROLE SUMMARY

Our Global Cybersecurity Governance, Risk, and Compliance (GRC) team provides comprehensive blueprints for cybersecurity excellence by embedding governance, risk management, and compliance into every layer. The team is responsible for ensuring risk-based decision-making is used, and that security, privacy, and regulatory compliance is integrated seamlessly with Pfizer’s organization.

We are seeking an experienced Senior Manager, Business Information Security Office (BISO) to serve as a trusted cybersecurity senior advisor and strategic liaison between the Cybersecurity organization and business stakeholders.

This role will lead the integration of cybersecurity requirements into major business initiatives, technology programs, and risk decisions, while also providing mentorship and guidance to BISO Managers and contributing to the overall strategy and maturity of the BISO enablement function.

##

ROLE RESPONSIBILITIES

• Serve as the senior cybersecurity point of contact and trusted advisor for assigned business functions, providing strategic guidance on cyber risk, policy requirements, and control expectations at an executive level.

• Partner with senior business, digital, product, quality, privacy, legal, and compliance stakeholders to embed cybersecurity into enterprise-level business processes, technology initiatives, and transformation programs.

• Lead the identification, assessment, and communication of complex cybersecurity risks impacting business operations, critical assets, data, and third-party relationships, including risks with significant organizational or regulatory exposure.

• Own cybersecurity engagement across major, high-visibility business initiatives, including solution profiling, risk assessments, control applicability, and remediation planning.

• Translate cybersecurity policies, standards, and regulatory requirements into strategic business guidance and actionable requirements for senior stakeholders and leadership.

• Own and present cybersecurity risk posture, compliance status, open issues, exceptions, and remediation progress for assigned business areas to senior leadership and governance forums.

• Provide mentorship, coaching, and guidance to BISO Managers, supporting their development and consistency of approach across the team.

• Coordinate and lead cross-functional alignment with Cyber GRC, security architecture, privacy, third-party risk, incident response, and technology teams to ensure consistent, enterprise-wide risk management practices.

• Lead business readiness for audits, inspections, regulatory inquiries, and internal assessments, coordinating responses and evidence collection across multiple business areas.

• Advise senior business stakeholders on cybersecurity implications related to new technologies, process changes, data use, cloud adoption, and vendor engagements, including at a strategic and enterprise-risk level.

• Drive organization-wide awareness and adoption of cybersecurity requirements, including data protection, access management, secure technology use, and risk acceptance processes.

• Identify systemic control gaps, risk themes, and process improvement opportunities across business functions, and lead initiatives to address them.

• Prepare and deliver executive-ready reporting, metrics, dashboards, and briefing materials for senior business leadership and cyber governance forums.

• Lead the ongoing enhancement of the BISO operating model, engagement processes, governance routines, and stakeholder communications, contributing directly to the strategic direction of the BISO enablement organization.

• Champion a risk-based, business-aligned cybersecurity culture that enables innovation while protecting company assets, regulated data, and critical operations.

Here Is What You Need (Minimum Requirements)

• Applicant must have a bachelor's degree in Cybersecurity, Information Technology, Risk Management, Business, or a related field with at least 6 years of

experience in cybersecurity, technology risk, information security, IT governance, compliance, or related disciplines, including demonstrated experience operating at a senior or leadership level; OR a master's degree with at least 5 years of experience in cybersecurity, technology risk, information security, IT governance, compliance, or related disciplines, including demonstrated experience operating at a senior or leadership level; OR a PhD with 1+ years of experience in cybersecurity, technology risk, information security, IT governance, compliance, or related disciplines, including demonstrated experience operating at a senior or leadership level.

• Proven experience partnering with senior business stakeholders to assess cyber risk, communicate requirements, and drive remediation activities at an enterprise scale.

• Strong, hands-onunderstanding of cybersecurity frameworks, policies, and controls, such as NIST CSF, ISO 27001, CIS Controls, or related industry standards, with the ability to apply and adapt these across varied business contexts.

• Demonstrated ability to translate complex technical and risk concepts into clear, executive-relevant messaging and strategic recommendations.

• Strong stakeholder management, communication, facilitation, and influencing skills, including experience engaging senior leadership and governance forums.

• Proven experience with GRC platforms, risk registers, control assessment processes, audit support, and exception management.

• Experience mentoring, coaching, or leading other cybersecurity or GRC professionals.

• Demonstrated experience in an agile work environment possessing qualities such as a collaborative mindset, adaptability to change, and a proactive problem-solving approach.

Bonus Points If You Have (Preferred Requirements)

• Relevant professional certifications (e.g., CISSP, CISA, CRISC, CISM, or similar) strongly preferred.

• Experience in a highly regulated environment; pharmaceutical, healthcare, life sciences, or GxP experience is a strong plus.

• Business-minded cybersecurity professional with a practical, risk-based approach and a track record of influencing enterprise-level decisions.

• Strong relationship builder who can operate effectively across technical, business, and executive audiences, including at the C-suite or senior leadership level.

• Comfortable working in a matrixed, global, and regulated environment, with experience leading initiatives across multiple business units or geographies.

• Detail-oriented with strong follow-through, documentation, and issue management skills.

• Proven ability to balance risk management with business enablement while contributing to broader organizational strategy.

• Experience contributing to or shaping team structure, operating models, or organizational maturity initiatives.

##

PHYSICAL/MENTAL REQUIREMENTS

• No special physical requirements.

• Applicants should be capable of working through a personal laptop computer or mobile device for extended periods.

##

NON-STANDARD WORK SCHEDULE, TRAVEL OR ENVIRONMENT REQUIREMENTS

• Travel as required by the business (less than 20% domestic and/or international)

• Work Location Assignment: Must be able to work in assigned Pfizer office 2-3 days per week, or as needed by the business

• This role is NOT remote

• margin-top:0cm;"> margin-top:0cm;">undefined

Candidate demonstrates a breadth of diverse leadership experiences and capabilities including: the ability to influence and collaborate with peers, develop and coach others, oversee an