AI and Automation Engineer-Information Security Governance

At Roche you can show up as yourself, embraced for the unique qualities you bring. Our culture encourages personal expression, open dialogue, and genuine connections, where you are valued, accepted and respected for who you are, allowing you to thrive both personally and professionally. This is how we aim to prevent, stop and cure diseases and ensure everyone has access to healthcare today and for generations to come. Join Roche, where every voice matters.

The Position

The Information Security & Privacy By Design team is the engine behind Roche’s security governance. We design, deliver, and support the digital frameworks that protect our organization, including IRAAM (Information Risk Assessment And Mitigation), PETRA (Policy Exceptions Tool for Risk Assessment), OIA (Outsourcing Impact Assessment), and our cutting‑edge GenAI security agents.

As an AI & Automation Engineer

You are the vital architect bridging the gap between high-level security expertise and scalable, self‑service execution. Your mission is to democratize security and privacy knowledge by building intelligent agents and low‑code tools that empower Roche employees. You don’t just manage risk; you build the “digital brains” that make risk management proactive, intuitive, and frictionless.

You are an “implementer” who thrives on turning strategic advice into functional code. You believe that security governance is most effective when it is invisible, automated, and powered by data.

Description Of The Area

The Information Security & Privacy By Design team makes Roche’s information security governance accessible through actionable processes. The capabilities we provide enable Roche to identify, assess, monitor, and mitigate information risks, manage regulatory compliance, and oversee third‑party and personal data processing risks. Our processes are primarily instantiated in the ServiceNow IRM Platform. We work closely with Information Security, Privacy, Risk & Compliance, and IT teams to provide enterprise visibility into Roche’s information risk posture.

You’ll be working within the Information Security Governance (ISG) area. ISG is responsible for defining the strategic agenda for information security and privacy topics at the Roche Group level. This is realized within the global Information Security Management System (ISMS) which aligns business and IT strategies, business and technical projects, policies, standards, directives, procedures, governance, legal/regulatory compliance, and other requirements at a global level.

The Information Security & Privacy by Design area is accountable for co‑developing, in collaboration with key stakeholders, and stewardship of the strategic direction of the Information Risk Assessment processes based on organizational objectives, industry practices and legal/regulatory requirements - e.g. IRAAM, PETRA, OIA. This includes oversight, awareness, direction and continuous improvement to the end‑to‑end processes and their relevant risk modules in alignment with the global ISMS, corporate directives and Roche management systems (e.g. privacy, quality, risk).

Job Responsibilities

• AI Solution Development & Knowledge Engineering
• Security AI Stewardship: Own the development and roadmap of internal AI-based advisory tools. You will transform static security policies and KB articles into interactive, intelligent agents
• Retrieval Augmented Generation (RAG): Build and optimize data pipelines to ingest diverse sources—including Google Docs, ServiceNow KB articles, and slide decks—into AI models to ensure accurate, grounded advisory
• Prompt Engineering & Tuning: Continuously refine LLM performance to ensure security and privacy advice is technically sound, brand‑aligned, and user‑friendly
• Low‑Code & Automation Engineering
• Self‑Service Platforms: Leverage Roche’s low‑code platforms( e.g. LEAP Outsystems or similar) to build front‑end interfaces that provide employees with 24/7 security guidance
• Workflow Automation: Identify manual bottlenecks in the IRAAM/PETRA/OIA workflows and engineer automated solutions to streamline the user journey
• Infrastructure Maintenance: Maintain and optimize essential operational tools (e.g., Google Apps Script used for the Security Expert Review Triage) ensuring reliable data aggregation from Snowflake, Thoughtspot, and ServiceNow
• Operational Excellence & Support
• Technical Support: Act as the primary technical contact for AI and automation tool incidents, troubleshooting issues and coordinating with platform teams for permanent fixes
• User Enablement: Support the Information Security Coordinator (ISC) network and end‑users, ensuring they understand how to maximize the value of our automated security tools
• Performance Monitoring: Analyse tool usage and AI response accuracy, using data insights to propose