Sr. Security Compliance Analyst

About Astellas

Astellas is a global life sciences company committed to turning innovative science into VALUE for patients. We provide transformative therapies in disease areas that include oncology, ophthalmology, urology, immunology and women's health. Through our research and development programs, we are pioneering new healthcare solutions for diseases with high unmet medical need. Learn more at Astellas.com.

Are you driven to make a real difference in the lives of patients?

We're seeking passionate individuals who thrive in dynamic environments, embrace new ideas, and aren't afraid to take intelligent risks. People who act with unwavering integrity and are deeply committed to making a tangible impact.

Purpose and Scope:

Help a global pharmaceutical company adopt new technology, including AI, safely. As Sr. Security Compliance Analyst, you will make sure the systems Astellas buys, builds and runs are secure from the start: setting clear security requirements, confirming they are met before go-live, and monitoring them once systems are in use. You will work with project teams, vendors and quality colleagues across the US, Europe, Japan and India, and help shape how Astellas secures emerging technology such as AI.

Responsibilities and Accountabilities:

Scope: Third-party and cloud (SaaS) solutions, in-house built applications and AI systems (models, agents, copilots), for both GxP (FDA/EU-regulated) and non-regulated use.

• Plan & Design: Join new projects early to identify security and compliance risks; assess vendors and cloud services before contracts are signed (e.g., SOC 2 reports, ISO 27001 certifications, security questionnaires); make sure contracts include the right security terms; and assess risks in new AI tools with our AI Security team.

• Requirements & Standards: Own the security requirements in Astellas' System Life Cycle (SLC), our process for delivering and validating systems, keeping them clear, testable and tied to policy and regulation (e.g., 21 CFR Part 11, EU Annex 11); keep security standards current as policies, threats and technologies such as AI evolve; and tailor requirements to each system's type and risk.

• Build & Change: Review specifications, designs and test evidence to confirm security requirements are met before go-live and with every change; provide the security sign-off at key project checkpoints and in change control; and drive gaps to resolution or manage formal, time-limited exceptions.

• Operate & Monitor: Run periodic reviews of live systems and reassess key vendors; track open risks and exceptions through to closure; maintain the technology risk register and report on risk to leadership; run and improve risk and vendor-risk workflows in OneTrust; and, when systems or vendor relationships end, confirm access is removed and data is returned or destroyed.

• Partnership & Governance: Act as Cybersecurity's partner to our IT quality and compliance team, keeping security and quality requirements aligned and free of duplication, including for AI systems; guide and train system owners, project teams and vendors; support audits and assessments with evidence; and work with procurement, legal and quality colleagues across regions.