> Markdown version of [/jobs/ext/2281751-biso-commercial-it](https://www.wearedevelopers.com/jobs/ext/2281751-biso-commercial-it). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# BISO - Commercial IT

- **Company:** AstraZeneca plc
- **Location:** Gaithersburg, MD, United States
- **Experience:** Expert
- **Salary:** $190,957.0 - $286,435.0
- **Contract:** Permanent contract
- **Skills:** Adobe Analytics, Adobe Marketing Cloud, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Data Analysis, Software System Penetration Testing, Audit Trail, Software as a Service, Cloud Computing, Cloud Computing Security, Cyber Security, Customer Data Management, Data Governance, Data Infrastructure, Data Security, Digital Content, Identity and Access Management, Key Management, OAuth, Power BI, Cloud Services, Phishing, Salesforce.Com, Data Logging, Software Security, Informatica Cloud, Adobe Target, Web Content, Data Analytics, Tealium, Integration Frameworks, Data Management, Veeva, Ddos, VeevaVault, Marketing Cloud, Mulesoft, Databricks
- **Published:** August 28, 2026
- **Apply:** https://www.jofdav.com/jobs/59420971-biso-commercial-it

## About the Role

* Information security leadership: 10+ years of experience in information security positions, with 5+ years' experience overseeing an information security functionand influencing senior business/IT stakeholders.
 * Commercial pharma domain familiarity: Experience supporting Commercial/Go-to-Market functions in a regulated life sciences environment (marketing operations, sales operations, customer/HCP engagement, digital channels, and in-country execution models).
 * SaaS/CRM security depth: Hands-on experience securingVeeva CRM,Veeva Vault,Veeva OCE, and/orSalesforceecosystems (Service Cloud, Health Cloud, Life Sciences Cloud, Marketing Cloud, Data 360), including identity/access models, connected apps, environment strategy, secure configuration, and operational monitoring.
 * Digital experience and marketing technology security: Experience withAdobe Experience Manager,Adobe Analytics,Adobe Target, andTealium(or equivalent) including tag/consent governance, tracking controls, data-layer integrity, and security considerations for externally facing digital content.
 * Data platform and cloud security: Experience securingDatabricksandAWS-hosted data platforms, including IAM, network controls, encryption/KMS, logging/telemetry, data governance, and prevention/detection of data exfiltration.
 * Integration and API security: Experience with integration platforms such asMuleSoftandSnapLogic, with a strong understanding of API security patterns, OAuth/token hygiene, certificate lifecycle, secrets management, and secure data movement.
 * Commercial operations / revenue process awareness: Familiarity with commercial operations platforms such asModel Nand the control expectations when systems support pricing, contracting, rebates/chargebacks, and/or interfaces to order booking and revenue processes (includingSOX-relevantcontrol considerations).
 * Depth of knowledge in Frameworks and control implementation, Vulnerability and security testing management, Risk dashboarding and data-driven execution, Incident response collaboration are key attributes required for this role.
 * Stakeholder communication: Strong written and verbal communication skills with proven ability to present complex technical information to both technical and non-technical audiences, including Commercial leadership and in-country stakeholders.
 * Execution under pressure: Proven ability to manage competing priorities, operate under time constraints tied to launches or campaigns, and drive outcomes through influence across matrixed teams.
 * Bachelor's degree in science or relevant technical field of study; Master's preferred.

When we put unexpected teams in the same room, we unleash bold thinking with the power to encourage life-changing medicines. In-person working gives us the platform we need to connect, work at pace and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. But that doesn't mean we're not flexible. We balance the expectation of being in the office while respecting individual flexibility. Join us in our unique and ambitious world.

## Description

The Commercial IT Cybersecurity Business Information Security Officer (BISO) acts as the main cybersecurity partner to Commercial IT and related business areas. This role represents the CISO to lower cyber risk and improve resilience across platforms dedicated to clients and revenue generation. This role leads security for a SaaS-heavy, data-centric Commercial ecosystem spanning CRM, omnichannel engagement, digital experience, analytics and personalization, data and AI platforms, pricing and revenue, integration and API fabric, BI, and MDM. Key platforms include Veeva (CRM/Vault/OCE), Salesforce (Service/Health/Life Sciences/Marketing Cloud, Data 360), Adobe Experience Cloud (AEM/Analytics/Target), Tealium, Databricks on AWS, Model N, MuleSoft/SnapLogic, Power BI, and Reltio, supporting both global operations and localized implementation alongside agency and third-party delivery models., * Act as the Commercial IT security lead and CISO representative. Serve as the primary cybersecurity liaison for the commercial IT division and associated business units worldwide. Coordinate the security strategy with business objectives and customer-centered, revenue-enhancing outcomes.

 * Lead governance and risk-based decision-making by chairing or participating in key forums, ensuring risk visibility, documented risk acceptance and ownership, and translating enterprise security policy into Commercial-ready standards, guardrails, and roadmaps.
 * Provide continuous risk advisory and posture management by maintaining awareness of threat trends and regulatory drivers relevant to Commercial operations, proactively advising on priorities, architecture decisions, and long-term security posture.
 * Establish SaaS security governance across core Commercial platforms by defining and implementing secure configuration baselines, environment and tenant management, identity, SSO and MFA patterns, logging and monitoring, and continuous control monitoring for Veeva, Salesforce, Adobe Experience Cloud, Tealium, and connected tooling.
 * Strengthen digital channel and web experience security by partnering with digital teams to embed secure SDLC and release practices for externally hosted web content and experiences, aligning protections such as WAF, CDN and DDoS where applicable, and mitigating web-layer and brand-abuse risks including impersonation, account takeover, credential stuffing, web skimming and scraping.
 * Drive security controls aligned with privacy in marketing and data collection. Ensure consent, tracking governance, and secure handling of healthcare professional and consumer information across digital marketing operations. Follow GDPR and other global privacy rules.
 * Improve control maturity for commercial content, records and revenue interfaces by maturing controls for content lifecycle and records (including audit trail and e-signature expectations where applicable) and for financial and ordering interfaces where Commercial platforms touch revenue processes, including SOX-relevant controls.
 * Run vulnerability, audit, and testing remediation to closure. Facilitate risk assessment and ongoing maintenance across SaaS tenants, web properties, and integrations. Drive timely remediation of audit and penetration test findings while reducing repeat issues.
 * Enhance incident readiness and response coordination by partnering with enterprise SecOps to build Commercial-relevant playbooks, align crisis and BCP activities, support post-incident reviews, and drive business-centric improvements for scenarios such as SaaS compromise, third-party or agency incidents, data exposure and digital channel compromise.
 * Advance third-party and agency risk management by defining onboarding patterns, minimum control requirements and ongoing monitoring for Commercial vendors and agencies (creative, media/AdTech partners, event hosts, SaaS providers), ensuring clear remediation paths and exit strategies.
 * Measure and communicate outcomes through KPIs, OKRs, dashboards and reporting that demonstrate risk ownership, remediation throughput, control coverage and resilience improvements over time.
 * Champion security culture and targeted awareness by tailoring training and communications for Commercial roles and partner ecosystems on phishing and social engineering, safe SaaS usage, HCP and customer data handling, and reporting obligations.
 * Plan and oversee security initiatives and investment by shaping multi-year roadmaps, business cases and resource plans; overseeing delivery of security improvements aligned to Commercial programs including platform changes, integrations and data initiatives.
 * Lead and develop the BISO team by directing a group spanning risk reporting and analytics, risk management and remediation, and security consulting tailored to SaaS-heavy international Commercial operating models; setting clear goals tied to measurable risk reduction and resilience outcomes; coaching for high performance.


## Related Videos

- [WeAreDevelopers LIVE - Chrome for Sale? Comet - the upcoming perplexity browser Stealing and leaking](https://www.wearedevelopers.com/videos/1331-wearedevelopers-live-chrome-for-sale-comet-the-upcoming-perplexity-browser-stealing-and-leaking)
- [Keeping applications secure by evolving OAuth 2.0 and OpenID Connect](https://www.wearedevelopers.com/videos/100152-keeping-applications-secure-by-evolving-oauth-2-0-and-openid-connect)
- [Blueprints for Success: Steering a Global Data & AI Architecture](https://www.wearedevelopers.com/videos/1577-blueprints-for-success-steering-a-global-data-ai-architecture)
- [Micro-frontends anti-patterns](https://www.wearedevelopers.com/videos/299-micro-frontends-anti-patterns)
- [How to govern Vibe Coding for the Enterprise](https://www.wearedevelopers.com/videos/100290-how-to-govern-vibe-coding-for-the-enterprise)
- [Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers)
- [The Biggest German Tech Companies](https://www.wearedevelopers.com/magazine/424-the-biggest-german-tech-companies)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Best Companies to Work For in Berlin: Top 14 Companies in 2023 ](https://www.wearedevelopers.com/magazine/188-best-companies-to-work-for-in-berlin-top-14-companies-in-2023)
- [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production)