Director, IT Governance & Cybersecurity

About KalVista Pharmaceuticals, Inc. KalVista is a global pharmaceutical company dedicated to delivering life-changing oral therapies for individuals affected by rare diseases with significant unmet needs. The KalVista team discovered and developed EKTERLY®—the first and only oral on-demand treatment for hereditary angioedema (HAE)—and continues to work closely with the global HAE community to improve treatment and care for this disease around the world. For more information about KalVista, please visit www.kalvista.com and follow us on LinkedIn, X, Facebook and Instagram. ABOUT THE ROLE The Director, IT Governance, & Cybersecurity is a senior leadership role responsible for building, leading, and continuously maturing KalVista's information security and IT governance program. This individual will serve as the organization's primary cybersecurity leader, owning the full spectrum of IT governance, risk management, regulatory compliance, data protection, and hands-on cybersecurity operations and strategy. This role partners closely with senior executives and cross-functional leaders across HR, Finance, Legal, Regulatory Affairs, Quality, and IT to align the company's security posture with its business objectives, risk tolerance, and obligations under applicable laws and industry standards. As an emerging biotech, KalVista requires a leader who is equally comfortable setting strategic direction and rolling up their sleeves to execute. RESPONSIBILITIES Cybersecurity Leadership Own and lead the enterprise cybersecurity function, acting as the organization’s de facto CISO-equivalent Define, implement, and mature a cybersecurity strategy aligned to NIST CSF Lead and manage MSSP and third-party partners Oversee security operations and tooling (Azure Security, SentinelOne, Defender suite, Qualys, Mimecast, EOP, Meraki, Intune, AOVPN, GPOs) Develop and lead Incident Response Drive threat intelligence and vulnerability management Champion security awareness IT Governance & Risk Management Develop and maintain the enterprise IT governance framework. Own and execute IT Risk Management. Lead BC/DR planning and tabletop exercises. Provide risk reporting to leadership and Board. Compliance & Audit Develop and execute compliance strategy across InfoSec, privacy, and IT controls Own all security policies and SOPs Lead SOX ITGC audit coordination Ensure compliance with SOX, GDPR, HIPAA, 21 CFR Part 11, GxP Identify and remediate policy gaps Data Protection & Privacy Partner on data governance and privacy programs. Oversee data classification, DLP, access control Support privacy-by-design for new systems Vendor & Third-Party Security Lead vendor security assessments Establish third-party risk management Partner with Procurement and Legal on vendor security terms BASIC QUALIFICATIONS Bachelor’s degree in a related field 10+ years in cybersecurity, governance, risk, and compliance 4+ years director-level leadership Experience scaling cybersecurity in high-growth or resource-constrained settings MSSP management experience Regulated environment experience (SOX ITGC, GxP, FDA) PREFERRED QUALIFICATIONS Master’s degree or MBA with tech focus. Life sciences/biotech/pharma experience. Strong TPRM experience. Certifications: CISSP, CISM, CRISC, CISA Microsoft security certifications (SC-100, SC-200, AZ-500) Strong executive communication Deep Microsoft security stack expertise Proficiency with vulnerability management, SIEM, email security, endpoint protection Cloud security architecture (Azure preferred), IAM, zero trust Experience with Druva or similar backup solutions Frameworks & Regulatory Knowledge Expert familiarity with NIST CSF, ISO 27001, SOX, GDPR, HIPAA Working knowledge of GxP, 21 CFR Part 11 Experience applying CIS Controls EXPECTATIONS & COMPETENCIES Exceptional communication and executive presentation skills Strong cross-functional collaboration and influence Strategic and operational mindset High integrity, sound judgment, decisiveness under pressure Maintain CSF-aligned cybersecurity roadmap and risk register Lead mature IR program with playbooks and exercises Ensure strong oversight of MSSP and partners Maintain enforceable policies and close audit findings Embed privacy-by-design and least privilege principles OUR VISION We Deliver Novel Therapies That Empower People To Live Better Lives. Our OPERATING PRINCIPLES, referenced below, guide our behaviors and decisions: Define Success – And Then Deliver Act with outcomes in mind. Have high expectations. Details Matter. Be Data Driven And Openly Debate – But Be Decisive Time is valuable. Say the thing you can’t say. Understand timelines and meet them. Have An Ownership Mentality This is your company; treat it that way. Protect our resources, reputation, and results. Be Internally Collaborative And Externally Competitive We go further, faster, together. Have a bias for action, but bring others along. Offer solutions, not just problems. Good People = Great Company Act with integrity. Assume positive intent. Be Kind. Important Notice to Third-Party Recruiters & Staffing Agencies: The current job openings advertised on this website are for the sole purpose of candidates to apply directly. Unsolicited and anonymous CVs submitted in any manner to KalVista employees, including to employee personal e-mail accounts, are considered to be the property of KalVista and will not qualify for a fee to be paid. Referral fees will only be payable where KalVista has agreed with an agency to work on a specific appointment, and then only in conjunction with a fully-executed contract for service. If any Agency representative contacts a KalVista Hiring Manager or company employee, other than a member of the KalVista Talent Acquisition team, to solicit an appointment to engage on a job opening, that Agency will not be considered for that specific job opening or future opportunities with KalVista. Thank you for your understanding and cooperation. Pay Range $198,300—$242,375 USD