Sr Business Analyst (Pharmacovigilance & AI Systems)

ESSENTIAL DUTIES AND RESPONSIBILITIES
Requirements Engineering
Elicit, document and maintain URS and FRS for each platform module, using structured workshops, process walkthroughs, system demonstrations and review of current SOPs, work instructions and conventions.
Produce the supporting artefacts: as-is and to-be process maps, data-flow diagrams, user stories with acceptance criteria, business rules, data dictionaries, interface specifications and non-functional requirements (performance, availability, security, auditability, data retention).
Build and maintain the Requirements Traceability Matrix from URS to FRS to design, test cases and validation evidence, so every requirement can be implemented and tested.
Run requirement reviews with PV operations, Quality, IT Security, Data Privacy and Engineering; manage change control on approved requirements.
Prioritize with the Product Owner, write release-level scope statements and support sprint planning and backlog refinement.
Domain coverage
You will specify requirements across the following modules, working with the respective PV subject-matter experts:
Global and local literature search strategy management, database connectors (MEDLINE/PubMed, Embase and others), de-duplication, AI-assisted relevance screening and ICSR identification, full-text handling, reviewer workflow, hit-level audit trail, reconciliation and KPIs; alignment with GVP Module VI and local literature requirements.
Multi-channel intake (email, portal, call centre, partner feeds, literature, social media), duplicate detection, AI-assisted data extraction from unstructured sources, MedDRA and WHODrug coding support, seriousness and expectedness assessment, narrative generation with human review, E2B(R3) submission, follow-up management, and integration with safety databases (e.g. Argus, LifeSphere, Veeva Vault Safety).
Data sources (safety database, EudraVigilance, FAERS, literature), disproportionality and signal detection methods, signal validation, prioritisation, assessment and tracking workflows, signal-to-risk linkage, and documentation aligned to GVP Module IX.
Data retrieval and reconciliation, line listings and summary tabulations, AI-assisted section drafting with locked source-to-text traceability, author and reviewer workflow, version control, schedule and submission tracking, aligned to 21 CFR 314.80 and ICH E2C(R2).
Source and channel configuration, listening rules, AI classification of posts for potential adverse events, identifiability and validity criteria, PII handling, reviewer workflow and conversion to case intake, aligned to GVP Module VI and FDA guidance on internet and social media.
PSMF support, audit-trail reporting and query, compliance dashboards (timeliness, quality, backlog), deviation and CAPA linkage, document and training evidence retrieval, and the ability to reproduce any AI-assisted decision on request.
Agentic AI specifics
Define, for every agent in the platform, its role, inputs, tools, permitted actions and decision authority, and the human-in-the-loop checkpoints where a qualified person must review, approve or override.
Specify AI output acceptance criteria with the SMEs: target precision and recall for screening and classification tasks, confidence thresholds for auto-routing versus human review, and how performance is measured and monitored in production.
Write requirements for explainability and auditability of AI decisions: rationale capture, source citation, prompt and model version logging, reproducibility, and retention of the evidence an inspector would ask for.
Specify guardrails: what agents must never do without human approval (e.g. submit an ICSR, close a signal, finalise a report), handling of low-confidence or out-of-distribution inputs, and fallback behaviour when a model or tool is unavailable.
Define requirements for model lifecycle governance: evaluation datasets, change control for prompts and models, regression testing, periodic review, and restrictions on use of client data for model training.
Regulatory, quality and privacy compliance
Translate the following into explicit, testable requirements and work with Quality on validation strategy:
21 CFR Part 11 and EU GMP Annex 11: electronic records, electronic signatures, audit trails, access control, data integrity (ALCOA+), system security, record retention and retrieval.
GDPR and other applicable data-protection laws: lawful basis, data minimisation, pseudonymisation, data-subject rights, cross-border transfer, retention and deletion, privacy by design; support Data Protection Impact Assessments.
GVP Modules (notably I, II, IV, VI, VII, IX) and ICH E2B(R3), E2C(R2), E2D, E2E as they apply to each module.
Computerised system validation: GAMP 5 (second edition), risk-based and Computer Software Assurance approaches; author or contribute to validation plans, functional risk assessments, test strategies and traceability.
Quality Management System requirements for product development: SDLC procedures, change control, deviation and CAPA management, supplier qualification, documentation standards; alignment with ISO 9001 and information-security frameworks (ISO 27001, SOC 2).
Emerging AI-specific regulation and guidance (EU AI Act, FDA and EMA positions on AI in pharmacovigilance and GxP): assess applicability, track developments and reflect them in requirements.
Act as the requirements-side point of contact during internal audits and client or regulatory inspections of the platform.
Stakeholder and delivery
Work day-to-day with PV operations leads, medical reviewers, Quality Assurance, Data Privacy, IT Security, product management, UX, data scientists and engineers.
Support UAT: author or review test scripts against the FRS, coordinate business testers, triage defects and confirm requirement coverage.
Prepare release notes, user-facing functional documentation and training inputs for operations teams.
Contribute to client-facing material describing how the platform meets regulatory expectations.
MINIMUM KNOWLEDGE, SKILLS AND ABILITIES
Bachelor's degree in life sciences, pharmacy, nursing, medicine, computer science or a related field.
6+ years in pharmacovigilance or PV systems, with at least 3 years in a business analyst, systems analyst or product requirements role on GxP software.
Demonstrated experience authoring URS and FRS (and ideally validation documentation) for PV or other regulated life-sciences systems.
Working knowledge of at least four of the six domain areas above, gained in operations, a safety-system implementation or a technology vendor; hands-on familiarity with at least one commercial safety database (Argus, LifeSphere, Veeva Vault Safety or equivalent).
Solid understanding of 21 CFR Part 11, EU GMP Annex 11, data-integrity principles and GDPR, and of how they translate into system requirements.
Experience working within a QMS and formal SDLC (change control, CSV/CSA, traceability, deviation handling).
Practical understanding of how LLMs and AI agents work, their failure modes, and what it takes to make their output acceptable in a regulated setting. Prior involvement in an AI or automation project in PV is strongly preferred.
Strong analytical writing: you can produce a requirement that an engineer can build, a tester can test and an auditor can verify, without ambiguity.
Comfortable with Agile delivery and tools such as Jira, Confluence or Azure DevOps.
Preferred
Experience with E2B(R3) implementation, MedDRA and WHODrug coding, and EudraVigilance or FAERS data.
Experience specifying NLP, machine-learning or GenAI features (classification, extraction, summarisation) including evaluation metrics and acceptance criteria.
Familiarity with GAMP 5 second edition and the FDA Computer Software Assurance approach.
Awareness of the EU AI Act and of EMA/FDA reflection papers on AI in the medicinal-product lifecycle.
Prior participation in regulatory inspections or client audits of PV systems.
Certifications such as CBAP, PMI-PBA, or ISPE/GAMP training.

Employment type
Full-time

Work arrangement
Yes