Novo Nordisk

Novo Nordisk's corporate IT Security Standard, aligned with ISO 27001, applied across the application portfolio, but the portfolio had not been tested against it. I owned that assessment end to end. This was a portfolio-level internal assurance assessment, not end-to-end application delivery. I decomposed the standard and the minimum requirements for outsourced services into 136 assessable controls, designed the assessment instrument, held the budget and ran competitive supplier selection with the CVP. We engaged an independent firm with enough knowledge of the portfolio to make the findings defensible to Quality and audit.

I carried the assessment across the application-management organization through workshops, written guidance and structured interviews with application owners and architects. The assessment method, instrument, communications and interviews were designed and led in-house, with the external firm providing independent assurance. The 55+ application portfolio was assessed against all 136 controls, producing a traceable compliance matrix and more than 25 severity-rated observations.

I adjudicated findings with owners and architects, negotiated documented closure arrangements and reported to the Global Applications Board at CVP/VP level. The evidence also identified defects in the standard itself, so I authored formal changes to clarify accountability, separate conflated responsibilities and re-scope requirements that could not be operated as written.

Held direct people and budget accountability for a 20-person team of Application Managers, Business Analysts, and Change and Release Managers and a US$11M OPEX/CAPEX budget. Owned annual cost-centre budgeting, rolling forecasts, accruals and burn-rate management; budget performance was a formal management appraisal target. Owned the full talent lifecycle: designed roles and job descriptions against a structured job-sizing framework; designed and ran structured competency-based interviews; and hired and coached team members. Formally trained in MBTI, I used it as a core management framework to help staff understand their profiles and to shape team composition, coaching, individual and team development plans, performance conversations and succession planning. Managed performance through to separation where required.

Built Bangalore GBS's first team to reach 30% women representation, with diversity targets included in hiring and succession planning. Contributed manager-level talent and structure input to an organizational review run by executive management. Designed the shared-services model for seven regulated enterprise applications, including the service catalogue, SLAs, OLAs, cost model and chargeback approach, and managed the main service and product vendors.

Coordinated related security work across application, database, server and network layers. Workstreams included risk review, dispensations and compensating controls for nine operational applications using unsupported database versions; an enterprise patching workstream covering configuration-item reconciliation, supplier SOWs and budget planning; prioritized white-hat security assessments; service-account password resets; and a global intrusion-defence rollout with application whitelisting, an SLA, a Quality Plan and change communications.

Owned the annual review and update of the IT Security Standard and built a roadmap across governance, people, process and technology, with clear owners and executive follow-up. Secured PMO agreement to introduce a mandatory security review gate into project delivery, then worked with security and architecture experts to define review criteria for solution selection, architecture decisions and supplier contracts alongside the existing cloud review.

Ran portfolio governance for seven commercial off-the-shelf (COTS) applications supporting recruitment, learning, expenses, contracts, project portfolio management and IT service management. Each application followed a yearly governance calendar covering strategy and roadmap updates, investment and budget planning, application Change Advisory Boards, business-led application governance boards (SABs), SLA and KPI reviews, risk, licensing, access, continuity, audit readiness and super-user summits. Oversaw maintenance of user requirements (URS), functional and technical design specifications (FDS/TDS), validation plans and status reports, configuration records and the controlled application dossier known internally as the red binder.

Consolidated GxP and SOX risk and compliance reporting across the portfolio and managed suppliers through service catalogues, statements of work, performance commitments and escalation paths. Worked across super-user communities, business owners, application boards, Quality, Finance, IT leadership and vendors so decisions and required actions remained visible.

As CobiT DSS04 process owner, led the assessment of critical infrastructure services and their dependent applications. Mapped business impact, service dependencies and recovery tiers, and established RTO/RPO inputs. The results set the disaster-recovery strategy for the global application portfolio and became the basis for renegotiating NNIT's global infrastructure SLAs, reducing SLA cost by 14%.

Under Quality Assurance oversight, each application owner had to update and file an application-specific DR strategy, with 11 representative applications selected for QA-witnessed recovery testing.

Designed monitoring points from each application's Threat, Vulnerability and Controls Assessment (TVCA), business data, business processes and Business Impact Assessment. Identified what had to be monitored across application, middleware, database and infrastructure layers; defined Splunk agent and collector patterns for centralized ingestion and correlation; and optimized log flow and events per second (EPS) because EPS drove platform sizing and cost.

Led scoping, proof of concept, Quality Plan and onboarding. The service closed an enterprise-wide corporate non-conformity and met IT Security and 21 CFR Part 11 requirements described as essential to license to operate.

Helped define the future-state maturity and competency model for enterprise application management and institutionalized it through an application-management centre of excellence. Set role expectations, governance forums, required artifacts, service standards, training and professional-development needs. As headquarters Transition Manager reporting directly to the CVP of ITS, was accountable for planning and managing the transition of seven highly business-critical applications from headquarters during 2014-2016, together with an annual intake of two to six applications from lines of business or projects.

Defined the global governance and end-to-end transition process, managed the assigned transition budget, and set quality gates, organizational-change and evaluation requirements. Plans and governance moved through VP, CVP and SVP management forums. After moving to Copenhagen, I was also given direct management responsibility for two participants in Novo Nordisk's selective two-year graduate leadership program, built around three eight-month rotations to prepare future leaders. The three-layer, five-phase transition method transferred application-management capability and accountability from Denmark and the United States to India.

Over six years at Novo Nordisk I operated at three distinct altitudes, and the organization promoted me twice.

I began with accountable ownership of two regulated enterprise applications, working inside GxP operations: change control, validation records, vendor coordination and day-to-day accountability for whether each application operated as documented.

I then led the Finance, Legal, IT and HR Solution Centre, delivering regulated enterprise applications to lines of business under SLAs, with a service catalogue, an OPEX/CAPEX budget and accountability for hiring, performance and succession. This was line leadership: permanent reports, cost-centre ownership and supplier performance.

The second and larger promotion moved me from Bangalore Global Business Services to a direct staff role at headquarters in Copenhagen, reporting to a CVP within a leadership group largely composed of VPs. I was assigned to board-sponsored mandates for the shared security, resilience, continuity and platform-control layer across 55+ corporate applications, not end-to-end delivery of those applications. The mandates had no standing delivery team, so I mobilized matrixed teams of five to sixty people for each one. Alongside this work, I retained direct line-management responsibility for two participants in Novo Nordisk's graduate leadership program.

Led an upgrade to an internally hosted performance-management application so it could support matrix reporting and project goals. Took the work through implementation while keeping the required regulated controls in place.

Led the early phases of a Clarity PPM upgrade or replacement. Defined the problem, aligned stakeholders, compared options and ran a proof of concept before an investment decision.