Lead/Manager Platform Complaince & Qualification

PLATFORM COMPLIANCE & QUALIFICATION LEAD
LOCATION: Remote | Type: Contract
About Newpage Solutions
Newpage Solutions is a global digital health innovation company helping people live longer, healthier lives. We partner with life sciences organisations which include, pharmaceutical, biotech and healthcare leaders, to build transformative AI and data driven technologies addressing real-world health challenges.
From strategy and research to UX design and agile development, we deliver and validate impactful solutions using lean, human-centered practices.
We are proud to be a Great Place to Work certified company for the last three consecutive years. We also hold a top Glassdoor rating and are named among the "Top 50 Most Promising Healthcare Solution Providers" by CIOReview. As an organisation, we foster creativity, continuous learning and inclusivity, creating an environment where bold ideas thrive and make a measurable difference in people s lives.
Your Mission
We are hiring a Platform Compliance & Qualification Lead to stand up and run a shared compliance service for the Platform Engineering organization of one of the world s largest pharmaceutical companies making compliance operational, scalable, and repeatable without adding process overhead to the teams building the platforms. You will be the onshore face of the function: owning program leadership, control strategy and design, and the cross-functional relationships with Security, Privacy, Legal, GRC, Quality, and Engineering. You will translate the client s regulatory interpretation into concrete, evidenced platform controls, and lead audit and inspection readiness across every platform the function supports from security and observability platforms to developer tooling and future platform initiatives.
This is a senior, hands-on leadership role. You set the strategy and own the client relationship, and you direct a dedicated offshore team of Newpage specialists who execute qualification, evidence management, and recurring control operations. It suits someone who has qualified platforms and infrastructure not just applications and who believes good compliance is engineered in, not bolted on.
The Three Pillars
Establish. Design, implement, and evidence the controls needed to qualify platforms and services qualification and validation planning, control design, supplier onboarding and vendor oversight, SDLC governance and documentation, requirements traceability, risk assessments, evidence collection, and platform qualification packages.
Sustain. Operate the recurring controls that keep platforms in a compliant state over time periodic and privileged access reviews, vendor oversight, change management evidence reviews, SLA and operational control reviews, compliance metrics and reporting, and governance support.
Audit Ready. Maintain a continuously auditable operating environment readiness assessments and internal reviews, audit package preparation, evidence and documentation management, inspection support, corrective action tracking, and continuous control monitoring.
You will execute across all three pillars. The function is a shared service it supports platform teams but does not own their engineering delivery and regulatory interpretation, final positions, and sign-off remain with the client s Compliance, Quality, and Legal functions.
What You Ll Do
Lead The Programme
Own the operating model, intake process, roadmap, and delivery cadence for the compliance and qualification function across all supported platforms and future platform initiatives.
Direct and prioritize the offshore specialist team s work; set the standard for quality, turnaround, and evidence completeness, and review what goes out the door.
Report compliance posture, progress, and risk to client platform leadership; run the governance forums and produce the metrics that keep them honest.
Right-size process make compliance repeatable and self-serve for engineering teams and push back on overhead that does not reduce risk.
Design Control Strategy
Apply the client s regulatory interpretation quality, privacy, and security requirements to platform-level control strategies and control designs.
Lead qualification and validation planning for new platforms and material changes; define what must be evidenced, by whom, and how.
Own the requirements traceability and risk assessment approach across the platform portfolio, and the structure of platform qualification packages.
Contribute input to regulatory positions where platform realities demand it, while respecting that final positions and sign-off rest with the client.
Engage Across Functions
Be the primary interface between Platform Engineering and Security, Privacy, Legal, GRC, and Quality resolving ambiguity so engineering teams don t have to.
Own the supplier onboarding and vendor oversight strategy for platform third parties and SaaS services.
Coach engineering teams on building compliance in SDLC governance, documentation, change evidence without slowing them down.
Communicate at every altitude: a control strategy for a platform architect, a governance readout for a VP, and an audit narrative for an inspector.
Lead Audit and Inspection Readiness
Own readiness end to end: platform readiness evaluations, gap assessments, control maturity reviews, evidence quality reviews, and remediation planning.
Lead audit package preparation and coordinate inspection support across the platform teams and client functions.
Track corrective actions to closure and drive continuous control monitoring so the environment stays auditable between audits.
Own program-level governance documentation and audit narratives.
What You Bring
Compliance and Qualification
10+ years in IT compliance, computer system validation and qualification, or IT quality in a regulated industry, including 5+ years in life sciences or pharma.
Deep working knowledge of the regulatory and quality frameworks governing computerised system qualification and validation in pharma, and of the IT general controls, security, and privacy requirements that sit alongside them.
A track record of qualifying platforms, cloud services, and infrastructure not only applications including SaaS and vendor-managed services.
Experience designing control frameworks and evidence models, not just executing someone else s checklist.
Platform and Engineering Fluency
Comfortable with modern platform engineering: cloud (AWS, Azure, or GCP), CI/CD, infrastructure as code, developer tooling, security tooling, and identity and access management.
Able to read an architecture diagram, a pipeline, or an access model and identify where controls need to live and how they can be evidenced automatically.
Familiarity with continuous compliance and compliance-as-code approaches, and an instinct for what can be automated versus what genuinely needs a human review.
Leadership And Stakeholder Management
Experience leading a compliance program or function with a distributed team; directing offshore delivery is a strong plus.
Credibility with senior stakeholders across Security, Privacy, Legal, GRC, Quality, and Engineering and the judgement to disagree with them constructively.
Audit and inspection experience: preparation, package readiness, and coordination with internal audit and external regulators.
Excellent written communication control strategies, governance documents, and audit narratives that stand on their own without you in the room.
Foundations
Based in the United States and able to work onshore client hours, with regular overlap for an India-based team.
Bachelor s degree in computer science, Engineering, Life Sciences, or a related field.
Willingness to travel to client sites as the engagement requires.
Bonus Skills/Experience
Experience leading a shared-service or compliance enablement function supporting multiple platform or product teams.
Background at a large pharma, or at a Big Four or GRC consultancy serving pharma clients.
Exposure to AI/ML platform governance and the emerging regulation around AI-enabled systems.
Hands-on with GRC and quality tooling such as ServiceNow GRC/IRM, Archer, Veeva Vault, Jira, and Confluence.
Cybersecurity exposure security controls, risk assessment, or working alongside a security or GRC function on platform controls.
Relevant compliance, audit, or security certifications.
What Success Looks Like
By 90 days. The operating model, intake process, and control strategy are agreed with the client; the offshore team is onboarded and executing; the first platform readiness assessment is complete.
By six months. Qualification packages are delivered for the initial platforms, recurring controls are running on cadence with metrics, and the function is the default route for platform compliance questions.
By a year. The environment is continuously auditable, the audit and inspection readiness record is clean, and engineering teams can point to a measurable reduction in the compliance effort they carry themselves.
What We Offer
At N

Work arrangement
Yes