Vice President, Chief Information Security Officer (CISO) Greater San Diego, CA Area

Who We Are:

Neurocrine Biosciences is a leading biopharmaceutical company with a simple purpose: to relieve suffering for people with great needs. We are dedicated to discovering, developing and commercializing life-changing treatments for patients with under-addressed neurological, psychiatric, endocrine and immunological disorders. The company's diverse portfolio includes FDA-approved treatments for tardive dyskinesia, chorea associated with Huntington's disease, classic congenital adrenal hyperplasia, hyperphagia in Prader-Willi syndrome, endometriosis* and uterine fibroids*, as well as a robust pipeline including multiple compounds in mid- to late-phase clinical development across our core therapeutic areas. For more than three decades, we have applied our unique insight into neuroscience and the interconnections between brain and body systems to treat complex conditions. We relentlessly pursue medicines to ease the burden of debilitating diseases and disorders, because you deserve brave science. For more information, visit neurocrine.com, and follow the company on LinkedIn, X, Facebook and YouTube. (*in collaboration with AbbVie)

At Neurocrine, strong leadership drives both business results and team success. We look for leaders who think strategically, anticipate what’s ahead and set clear direction, while building and empowering high-performing teams. Successful leaders foster an environment where people are motivated to do their best work and deliver meaningful, measurable impact through sound decision-making and accountability.

About the Role:

Provides strategic and organizational leadership for the company’s information security and cybersecurity program, establishing the vision, strategy, governance, architecture, policies, and controls necessary to protect the company’s information, technology, and digital assets. Serves as a trusted advisor to executive leadership and partners across the enterprise to identify and manage cyber risk while enabling business objectives, innovation, and an effective employee and customer experience. Safeguards the scientific, clinical, and corporate data that underpin Neurocrine’s drug discovery and development mission, including GxP-validated systems and clinical trial platforms.

Builds advocacy, trust, and shared accountability for security across the organization through strong cross-functional partnership, clear and effective communication, sound judgment, and proactive stakeholder engagement. Balances the urgency of security and risk mitigation with business priorities, operational needs, regulatory requirements, and user experience to implement controls that are appropriately risk-based, practical, scalable, and sustainable.

Leads and develops a high-performing cybersecurity organization and fosters a culture in which security is viewed as an enterprise enabler and shared responsibility. Anticipates the organizational impact of security decisions, effectively influences stakeholders at all levels, and ensures cybersecurity capabilities evolve with the company’s business strategy, technology landscape, and threat environment. Partners directly with the Board of Directors and Audit/Risk Committee to ensure cyber risk oversight is embedded in enterprise governance.

_

Your Contributions (include, but are not limited to):

Assess the current state of the information security program and develop and execute a strategic roadmap to evolve and mature cybersecurity capabilities in alignment with the company’s business strategy, risk profile, regulatory requirements, and technology environment

Identify and assess information security priorities, emerging threats, vulnerabilities, and control gaps; monitor compliance with established standards and policies; and apply sound, risk-based judgment to prioritize remediation based on business impact, likelihood, and organizational risk

Establish annual and long-range security and compliance goals, strategies, performance metrics, reporting mechanisms, maturity models, and roadmaps that demonstrate measurable improvement in cybersecurity capabilities and risk reduction

Develop and oversee a comprehensive Identity and Access Management strategy and architecture, including appropriate governance, privileged access, authentication, authorization, and lifecycle management

Serve as a trusted cybersecurity advisor to executive leadership and business leaders, translating complex cybersecurity risks into clear business implications, options, and recommendations that enable informed decision-making

Represent Neurocrine’s information security posture and program with key customers, partners, regulators, auditors, and other internal and external stakeholders, as appropriate

Create a culture of information security awareness through effective training, communications, and engagement programs that promote shared accountability for protecting company information and systems

Collaborate proactively with cross-functional leaders to understand business and technical requirements and develop security solutions that appropriately balance risk mitigation, regulatory requirements, business enablement, operational practicality, and employee/user experience

Build alignment with impacted stakeholders before implementing significant security policies, controls, technologies, or changes; anticipate downstream organizational impacts and establish appropriate change management, communication, and adoption plans

Exercise sound executive judgment regarding the urgency, sequencing, and proportionality of cybersecurity actions, balancing immediate security concerns with broader enterprise priorities and operational considerations

Lead the company’s cybersecurity incident preparedness and response capabilities, including executive coordination, crisis management, escalation, investigation, containment, recovery, and lessons learned in partnership with Legal, Privacy, IT, Communications, and other appropriate functions

Provide the Board of Directors and executive leadership with clear, concise, and appropriately calibrated reporting on cybersecurity risk, threat landscape, program maturity, significant incidents, priorities, and progress

Establish effective cybersecurity governance and risk-management processes, including clear decision rights, escalation thresholds, risk acceptance processes, third-party cybersecurity risk management, and appropriate coordination with enterprise risk management. Given Neurocrine’s reliance on CROs, CDMOs, and other outsourced partners across the drug development and manufacturing supply chain, third-party risk management should explicitly address this extended regulated ecosystem

Build, lead, develop, and retain a high-performing cybersecurity organization; establish clear accountability and expectations while fostering collaboration, constructive challenge, professional development, and strong partnerships across IT and the broader company

Continuously evaluate emerging technologies, including cloud, data, AI and automation, to understand both new cybersecurity risks and opportunities to improve security capabilities and operational effectiveness

Ensure the security, integrity, and availability of GxP-validated systems (e.g., LIMS, MES, clinical trial and pharmacovigilance platforms) in partnership with Quality, IT, and R&D, maintaining alignment with applicable data integrity requirements

Protect Neurocrine’s drug discovery, clinical, and manufacturing intellectual property and trade secrets from theft by sophisticated threat actors — including nation-state and industrial espionage activity common in the biotech/pharma sector — in partnership with R&D, Legal, and IP Counsel

Other duties as assigned

Requirements:

24+ years equivalent combination of education and experience

Bachelor’s degree in an applicable field AND 20+ years of applicable experience OR

Master’s degree AND 16+ years of applicable experience OR

JD, PharmD, or PhD AND 14+ years of applicable experience OR

MD (or equivalent) AND 8+ years of applicable experience

Consistently acts as a trusted advisor to executive leadership, business partners, and key stakeholders, bringing credibility, sound judgment, and deep cybersecurity expertise; may be recognized as an external expert in the field

Strategic and progressive thinker and change leader with the ability to establish a compelling cybersecurity vision and translate it into pragmatic strategies, priorities, and measurable outcomes aligned with company objectives

Demonstrated executive-level judgment and decision-making, with the ability to assess complex and ambiguous situations, understand broader organizational impacts, appropriately balance cybersecurity risk with business priorities and user experience, and determine when to escalate, accelerate, or adjust an approach

Exceptional ability to influence, collaborate, and build alignment across functions and levels of the organization without relying solely on authority. Demonstrates strong executive communication skills, including the ability to listen, adapt communication to the audience, constructively challenge when appropriate, and translate complex cybersecurity issues into clear business risks, options, and recommendations

Proven ability to lead, develop, mentor, and motivate high-performing teams; establishes clear accountability while creating an environment that promotes collaboration, professional development, engagement, and strong partnerships

Strong business acumen with the ability to understand Neurocrine’s business strategies, operating environment, technology landscape, and objectives and translate them into appropriate cybersecurity priorities and capabilities

Demonstrated ability to anticipate emerging risks and opportunities, understand the external threat and regulatory environment, identify root causes, reduce complexity, and develop practical, scalable, and risk-based solutions

Strong analytical capabilities with demonstrated ability to structure and interpret quantitative and qualitative information, establish meaningful metrics, and use data and risk insights to support decision-making and communicate cybersecurity posture and program effectiveness

Exemplifies Neurocrine’s core values of passion, integrity, collaboration, innovation, and tenacity and demonstrates the personal and business integrity necessary to establish trust with employees, executives, the Board, and external stakeholders

Demonstrated ability to operate effectively in a complex, cross-functional and matrixed environment, proactively engaging stakeholders and incorporating business, Legal, Privacy, Compliance, IT, and other perspectives into cybersecurity decisions and initiatives

Deep knowledge of cybersecurity risk management, applicable regulatory and compliance requirements, data protection requirements, and recognized cybersecurity frameworks and industry best practices, with the ability to apply them appropriately to the company’s risk profile and operating environment

Extensive expertise in security architecture and technologies, including cloud security, identity and access management, infrastructure and endpoint security, security operations, vulnerability management, incident response, third-party risk, and modern enterprise technology environments

Strong understanding of emerging technology and associated cybersecurity considerations, including cloud, data, artificial intelligence, automation, and evolving digital technologies, with the ability to assess both risks and opportunities for the organization

Demonstrated financial and operational management capabilities, including development and management of budgets, forecasts, resource plans, vendor relationships, and cybersecurity investments based on business value and risk reduction

Working knowledge of FDA regulations, GxP requirements, and data integrity principles as they apply to information systems supporting drug discovery, clinical development, and manufacturing

#LI-CL1

Neurocrine Biosciences is an EEO/Disability/Vets employer.

We are committed to building a workplace of belonging, respect, and empowerment, and we recognize there are a variety of ways to meet our requirements. We are looking for the best candidate for the job and encourage you to apply even if your experience or qualifications don’t line up to exactly what we have outlined in the job description.

_

The annual base salary we reasonably expect to pay is $269,700.00-$368,000.00. Individual pay decisions depend on various factors, such as primary work location, complexity and responsibility of role, job duties/requirements, and relevant experience and skills. In addition, this position offers an annual bonus with a target of 40% of the earned base salary and eligibility to participate in our equity based long term incentive program. Benefits offered include a retirement savings plan (with company match), paid vacation, holiday and personal days, paid caregiver/parental and medical leave, and health benefits to include medical, prescription drug, dental and vision coverage in accordance with the terms and conditions of the applicable plans.