Job description

At Gilead, we’re creating a healthier world for all people. For more than 35 years, we’ve tackled diseases such as HIV, viral hepatitis, COVID-19 and cancer – working relentlessly to develop therapies that help improve lives and to ensure access to these therapies across the globe. We continue to fight against the world’s biggest health challenges, and our mission requires collaboration, determination and a relentless drive to make a difference. Every member of Gilead’s team plays a critical role in the discovery and development of life-changing scientific innovations. Our employees are our greatest asset as we work to achieve our bold ambitions, and we’re looking for the next wave of passionate and ambitious people ready to make a direct impact. We believe every employee deserves a great leader. People Leaders are the cornerstone to the employee experience at Gilead and Kite. As a people leader now or in the future, you are the key driver in evolving our culture and creating an environment where every employee feels included, developed and empowered to fulfil their aspirations. Join Gilead and help create possible, together. Job Description Essential Job Functions: Owns enterprise IAM control effectiveness, ensuring identity governance, certification, and access controls are consistently enforced, measurable, and audit-ready across systems and data domains. Leads and governs DOJ Data Security Program (DSP) IAM controls, including definition, implementation, and ongoing validation of access restrictions protecting sensitive and regulated data. Drives and matures access certification programs, including campaign strategy, execution oversight, reviewer accountability, exception governance, and remediation enforcement. Owns role-based access control (RBAC) strategy and execution, including role engineering, role lifecycle management, and alignment to least privilege and compliance requirements. Establishes and enforces standardized access models and certification scope across enterprise and cloud applications, ensuring consistency and scalability. Oversees identity lifecycle management (joiner, mover, leaver) as a controlled process, ensuring timely and accurate provisioning aligned with authoritative data sources and governance policies. Provides leadership over IAM operations, including access request fulfillment, incident/problem management, and operational issue resolution across integrated platforms. Acts as service owner for IAM platforms, accountable for availability, performance, control enforcement, and continuous service improvement. Manages managed service providers and vendors supporting IAM, including defining SLAs/KPIs, monitoring performance, and enforcing delivery accountability. Drives onboarding of applications into IAM platforms with a focus on RBAC alignment, certification inclusion, and governance standardization, reducing control gaps. Ensures IAM processes and controls support audit, compliance, and regulatory readiness, including GxP and 21 CFR Part 11 requirements. Partners with Security, Architecture, and business stakeholders to evolve IAM control frameworks and improve governance effectiveness across the enterprise. Identifies and implements improvements to IAM processes, tools, and operating models to enhance control maturity, operational efficiency, and scalability. Required Skills & Job Qualifications: Bachelor’s degree plus 6 years of IT and/or Information Security experience. Strong experience owning and operating IAM governance and control functions, including certification and RBAC at enterprise scale. Hands-on experience with IAM platforms such as SailPoint IdentityIQ, SailPoint Identity Security Cloud, or Saviynt. Deep experience with access certification programs, RBAC design, and identity lifecycle governance. Understanding of regulatory-driven IAM controls, including DOJ DSP, GxP, and 21 CFR Part 11. Experience leading IAM operations and service delivery in complex, hybrid enterprise environments. Working knowledge of directory services (Active Directory, LDAP) and application integration patterns. Preferred Skills: Experience in pharmaceutical, biotech, or life sciences environments. Familiarity with evolving access control models (e.g., ABAC) and modern IAM architectures. Experience supporting regulatory audits and control validation activities. Broad knowledge of enterprise IT systems, cloud platforms, and application architectures. The salary range for this position is: $146,540.00 - $189,640.00. Gilead considers a variety of factors when determining base compensation, including experience, qualifications, and geographic location. These considerations mean actual compensation will vary. This position may also be eligible for a discretionary annual bonus, discretionary stock-based long-term incentives (eligibility may vary based on role), paid time off, and a benefits package. Benefits include company-sponsored medical, dental, vision, and life insurance plans*. For additional benefits information, visit: gilead.com * Eligible employees may participate in benefit plans, subject to the terms and conditions of the applicable plans. For jobs in the United States: Gilead Sciences Inc. is committed to providing equal employment opportunities to all employees and applicants for employment, and is dedicated to fostering an inclusive work environment comprised of diverse perspectives, backgrounds, and experiences. Employment decisions regarding recruitment and selection will be made without discrimination based on race, color, religion, national origin, sex , age, sexual orientation, physical or mental disability, genetic information or characteristic, gender identity and expression, veteran status, or other non-job related characteristics or other prohibited grounds specified in applicable federal, state and local laws. In order to ensure reasonable accommodation for individuals protected by Section 503 of the Rehabilitation Act of 1973, the Vietnam Era Veterans Readjustment Act of 1974, and Title I of the Americans with Disabilities Act of 1990, applicants who require accommodation in the job application process may contact ApplicantAccommodations gilead.com for assistance. For more information about equal employment opportunity protections, please view the Know Your Rights poster. NOTICE: EMPLOYEE POLYGRAPH PROTECTION ACT YOUR RIGHTS UNDER THE FAMILY AND MEDICAL LEAVE ACT Gilead Sciences will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, (c) consistent with the legal duty to furnish information; or (d) otherwise protected by law. Our environment respects individual differences and recognizes each employee as an integral member of our company. Our workforce reflects these values and celebrates the individuals who make up our growing team. Gilead provides a work environment free of harassment and prohibited conduct. We promote and support individual differences and diversity of thoughts and opinion. For Current Gilead Employees and Contractors: Please apply via the Internal Career Opportunities portal in Workday.

Requirements

Must-haves

Owns enterprise IAM control effectiveness, ensuring identity governance, certification, and access controls are consistently enforced, measurable, and audit-ready across systems and data domains.
Leads and governs DOJ Data Security Program (DSP) IAM controls, including definition, implementation, and ongoing validation of access restrictions protecting sensitive and regulated data.
Drives and matures access certification programs, including campaign strategy, execution oversight, reviewer accountability, exception governance, and remediation enforcement.
Owns role-based access control (RBAC) strategy and execution, including role engineering, role lifecycle management, and alignment to least privilege and compliance requirements.
Establishes and enforces standardized access models and certification scope across enterprise and cloud applications, ensuring consistency and scalability.
Oversees identity lifecycle management (joiner, mover, leaver) as a controlled process, ensuring timely and accurate provisioning aligned with authoritative data sources and governance policies.
Provides leadership over IAM operations, including access request fulfillment, incident/problem management, and operational issue resolution across integrated platforms.
Acts as service owner for IAM platforms, accountable for availability, performance, control enforcement, and continuous service improvement.
Manages managed service providers and vendors supporting IAM, including defining SLAs/KPIs, monitoring performance, and enforcing delivery accountability.
Drives onboarding of applications into IAM platforms with a focus on RBAC alignment, certification inclusion, and governance standardization, reducing control gaps.
Ensures IAM processes and controls support audit, compliance, and regulatory readiness, including GxP and 21 CFR Part 11 requirements.
Partners with Security, Architecture, and business stakeholders to evolve IAM control frameworks and improve governance effectiveness across the enterprise.
Identifies and implements improvements to IAM processes, tools, and operating models to enhance control maturity, operational efficiency, and scalability.
Bachelor’s degree plus 6 years of IT and/or Information Security experience.
Strong experience owning and operating IAM governance and control functions, including certification and RBAC at enterprise scale.
Hands-on experience with IAM platforms such as SailPoint IdentityIQ, SailPoint Identity Security Cloud, or Saviynt.
Deep experience with access certification programs, RBAC design, and identity lifecycle governance.
Understanding of regulatory-driven IAM controls, including DOJ DSP, GxP, and 21 CFR Part 11.
Experience leading IAM operations and service delivery in complex, hybrid enterprise environments.
Working knowledge of directory services (Active Directory, LDAP) and application integration patterns.

Nice-to-haves

Experience in pharmaceutical, biotech, or life sciences environments.
Familiarity with evolving access control models (e.g., ABAC) and modern IAM architectures.
Experience supporting regulatory audits and control validation activities.
Broad knowledge of enterprise IT systems, cloud platforms, and application architectures.

Application prep

Use the role’s language and application details while tailoring your materials.

Platform: workday
Effort: long

Benefits

Benefits detected in the listing.

Dental

Vision

Paid Time Off