Specialist IS Security Engineer
Notify me about similar jobsAbout this opportunity
Career Category
Engineering
Job Description
As a Specialist IS Security at Amgen, you will be responsible for analyzing business requirements and translating them into efficient and effective information systems solutions. You will collaborate with cross-functional teams to identify system enhancements, perform data analysis, troubleshoot issues, and support system implementation and maintenance. Your expertise in business process analysis and technology will contribute to the successful delivery of IT solutions that drive operational efficiency and meet business objectives.
Key Responsibilities
Lead the transformation and continuous improvement of Issue Management and Policy Exception capabilities, including workflows, governance, process standards, reporting, and stakeholder adoption.
Perform risk assessments and controls assurance activities, applying sound security and risk judgment to evaluate control effectiveness and residual risk.
Conduct detailed evidence reviews for issue closure and remediation, assessing whether evidence is sufficient, relevant, reliable, and supports closure.
Perform thematic risk reviews across issues, policy exceptions, ISRAs, and control findings to identify recurring control weaknesses, systemic risks, root causes, and opportunities for improvement.
Support ISRA controls assurance activities, including reviewing control evidence, identifying gaps, challenging findings, and improving the quality of risk and control assessments.
Provide advanced review and triage of issues and policy exceptions to ensure records are complete, risk-informed, appropriately documented, and decision-ready.
Monitor issue and exception queues, aging, bottlenecks, and dependencies, driving stakeholder follow-up and escalation to improve timely resolution.
Develop and maintain ServiceNow dashboards, reporting, and executive-level metrics that provide visibility into risk trends, control gaps, aging, and operational performance.
Translate complex risk, control, and operational findings into clear recommendations and actionable insights for leadership.
Partner with and influence cross-functional stakeholders to strengthen accountability, documentation quality, risk-based decision-making, and consistent process adoption.
Required Qualifications
8+ years of relevant experience in Information Security, GRC, IT Risk, Controls Assurance, Issue Management, Policy Exception Management, Security Engineering, or Internal Audit.
Strong hands-on background in risk assessment and controls assurance, including evaluating control design/effectiveness, identifying control gaps, and assessing risk.
Demonstrated experience reviewing and challenging evidence supporting issue closure, remediation, ISRAs, controls assurance, or similar risk and assurance activities.
Experience conducting thematic risk reviews, trend analysis, and root-cause analysis across issues, exceptions, risk assessments, and control findings.
Proven experience transforming or materially improving Issue Management and/or Policy Exception capabilities, including workflows, governance, reporting, quality, and operating processes.
Advanced experience with ServiceNow, including ticket management, workflow operations, queue management, dashboards, reporting, and metrics.
Strong understanding of issue lifecycle management, policy exceptions, remediation, risk acceptance, control evaluation, and evidence requirements.
Ability to independently assess complex risk and control scenarios, challenge conclusions and supporting evidence, and make well-reasoned recommendations.
Strong analytical and communication skills, with the ability to translate detailed risk and control findings into concise, executive-level insights.
Demonstrated ability to lead cross-functional improvements and influence technical and non-technical stakeholders without direct authority.
Relevant certifications such as CISA, CRISC, CISSP, ServiceNow are preferred.
.
Job details
How this role compares
Computed from every other active Information Technology role in our database, not just this employer's listings.
We currently track 1649 comparable Information Technology roles across 98 biopharma companies.
Salary context
226 of 1649 peers report a salary range (USD, annualized)
Peers share this role's job function. This posting doesn't list a seniority level, so peers aren't narrowed by seniority either -- the range below may span more levels than usual.
Where these roles are based
Top locations among the 1649 comparable roles
+ 38 more countries
Seniority mix
980 of 1649 peers have a known seniority level
Therapeutic area mix
9 of 1649 peers have a known therapeutic area; the rest are genuinely unlabeled, not hidden
Similar opportunities
The closest matches from our peer group, ranked by how similar they are, not how well you'd qualify for them -- treat this as market context, not a guaranteed shortlist; a weak match is labeled as one below.
Notify me about similar jobs
Get an email when we spot other openings like this one – same job function, comparable seniority, roles you'd actually want to see.
Or follow a whole field: get every new Information Technology job in India, and choose locations and companies.
How we calculate "similar"
No black box, no LLM guesswork: a deterministic score built from four normalized attributes. Here's this role's own peer group at different match levels, so you can see the mechanism, not just the result.
Every comparison starts from the same 100-point budget: 25 for working in the same function, 40 for the same therapeutic area, 20 for the same or adjacent seniority, 15 for the same country. A dimension we can't confirm on both sides contributes nothing, never a guess, never a free pass.
0 points, never a partial guess. A role we know almost nothing about beyond its function bottoms out at 25%; it never inflates to 100% just because there's little to compare against. Seniority uses a defined ladder (Associate → Manager → Associate Director → Senior → Principal → Director → Senior Director → Executive/VP) so "Director" and "Senior Director" count as adjacent, but "Director" and "Executive/VP" do not.