Control COE Lead

Welcome to Haleon. We’re a purpose-driven, world-class consumer company putting everyday health in the hands of millions. In just three years since our launch, we’ve grown, evolved and are now entering an exciting new chapter – one filled with bold ambitions and enormous opportunity.

Our trusted portfolio of brands – including Sensodyne®, Panadol®, Advil®, Voltaren®, Theraflu®, Otrivin®, and Centrum® – lead in resilient and growing categories. What sets us apart is our unique blend of deep human understanding and trusted science.

Now it’s time to fully realise the full potential of our business and our people. We do this through our Win as One strategy. It puts our purpose – to deliver better everyday health with humanity – at the heart of everything we do. It unites us, inspires us, and challenges us to be better every day, driven by our agile, performance-focused culture.

About the role

The Control COE Lead is responsible for developing, governing, and continuously improving the enterprise-wide control framework within Digital & Technology. The role leads the design, simplification, automation, standardisation, and rationalisation of controls across D&T, ensuring the control environment is efficient, modern, risk‑based, and aligned to regulatory, audit, and operational expectations.

The role oversees the definition of control standards, patterns, and reusable frameworks and works with control owners, product teams, architects, engineering, and compliance stakeholders to embed high-quality, sustainable control designs. The Control COE Lead drives automation opportunities across the control lifecycle, including preventative controls, detective controls, continuous monitoring, and digital evidence collection.

As a central authority for control excellence, the role ensures alignment across SOx, ITGC, cybersecurity, privacy, GxP and other compliance domains, reducing duplication, improving efficiency, and enabling a scalable, tech‑enabled control environment.

Role Responsibilities

• Lead the enterprise-wide redesign, simplification, and optimisation of the D&T control environment, including control mapping, duplication elimination, standardisation, and creation of reusable design patterns.
• Define and maintain D&T control standards, methodologies, and frameworks, ensuring alignment with SOx, ITGC, cybersecurity, and privacy control expectations.
• Drive automation of controls and evidence collection, partnering with engineering, automation teams, and GRC tooling teams to enable continuous monitoring, preventative controls, and tech‑enabled assurance
• Oversee the rationalisation of existing controls, including removal of redundant or ineffective controls, consolidation of overlapping controls, and replacement of manual processes with automated solutions.
• Provide expert advisory support to control owners, product teams, architects, and risk & compliance, ensuring new solutions and technology changes embed “compliance by design” and adopt approved control patterns.
• Lead continuous improvement initiatives across the control lifecycle, measuring control effectiveness, identifying systemic issues, and coordinating enhancements with senior stakeholders and cross‑functional teams.

Business Expertise

• Requires deep understanding of technology risk, SOx, ITGC, cybersecurity control frameworks, and GxP expectations, including how these apply to modern cloud, data, infrastructure, and product environments.
• Strong knowledge of control design principles, process optimisation, automation capabilities, and industry best practices for controls engineering.
• Ability to translate regulatory requirements (SOx, GxP, privacy, cybersecurity) into actionable, scalable, technology‑friendly controls.

• Broad understanding of modern digital architecture (cloud, identity, data, DevOps), enabling effective collaboration with engineering and architecture teams on embedding automated controls.
• Commercially aware with ability to prioritise control optimisation activities that drive the biggest impact on risk reduction, cost reduction, audit readiness, and operational efficiency.

Problem Solving

• Tackles highly complex challenges relating to inconsistent control design, legacy processes, and fragmented control ownership across D&T.
• Requires ability to evaluate root causes, identify structural issues, and propose scalable and simplified solutions that balance risk, audit needs, regulatory expectations, and business agility.
• Must innovate by introducing automation, continuous monitoring, control-as-code, and modern assurance methods.
• Challenges compounded by evolving regulatory requirements (SOx, cybersecurity), continuous technology changes, and differing levels of maturity across teams.
• Requires structured judgement to redesign controls that are both audit‑ready and aligned to modern technology delivery practices (agile, DevSecOps, product‑centric operating models).

Interactions / Interpersonal Skills

• Extensive engagement with control owners, engineers, architects, product leaders, security teams, risk & compliance, internal audit, quality (for GxP systems), and external auditors.
• Requires strong communication and stakeholder management skills to explain complex control redesign concepts in clear, simple terms suitable for both technical and business audiences.
• Must influence decision-making without direct authority, particularly when simplifying long‑standing legacy control processes.
• Skilled in negotiation, conflict resolution, and driving adoption of new standards across diverse teams and geographies.

Skills Qualifications

• Degree or equivalent professional experience in Information Systems, Risk Management, Business, or a related discipline
• At least 15+ years of experience in IT compliance, auditing, or risk management
• Experience in technology risk management, control design, or control operations.
• Hands-on experience with SOx, ITGC, cybersecurity controls, and ideally exposure to GxP control frameworks
• Demonstrated experience simplifying or redesigning controls or processes.
• Experience working with engineering teams on automation, workflow design, or continuous monitoring solutions.

Preferences:

• Leadership experience within a Control COE, Risk Engineering, Internal Controls, or Technology Governance function.
• Experience implementing control automation, control-as-code, or GRC tooling (e.g., Archer, ServiceNow GRC, SAP GRC).
• Experience designing enterprise control frameworks in cloud-native or hybrid environments.

• Experience leading cross-functional transformation or control rationalisation initiatives.

Relevant certifications in IT compliance or auditing such as:

• Certified Information Systems Auditor (CISA),
• Certified in Risk and Information Systems Control (CRISC),
• Certified in the Governance of Enterprise IT (CGEIT), or equivalent risk, audit, or technology governance qualifications.

 Job Posting End Date

Equal Opportunities

Haleon are committed to mobilising our purpose in a way that represents the diverse consumers and communities who rely on our brands every day. It guides us in creating an inclusive culture, where different backgrounds and views are valued and respected – all in support of understanding and best serving the needs of our consumers and unleashing the full potential of our people. It’s important to us that Haleon is a place where all our employees feel they truly belong.

During the application process, we may ask you to share some personal information, which is entirely voluntary. This information ensures we meet certain regulatory and reporting obligations and supports the development, refinement, and execution of our inclusion and belonging programmes that are open to all Haleon employees. 

The personal information you provide will be kept confidential, used only for legitimate business purposes, and will never be used in making any employment decisions, including hiring decisions.

Adjustment or Accommodations Request

If you require a reasonable adjustment or accommodation or other assistance to apply for a job at Haleon at any stage of the application process, please let your recruiter know by providing them with a description of specific adjustments you are requesting. We’ll provide all reasonable adjustments to support you throughout the recruitment process and treat all information you provide us in confidence. 

Note to candidates

The Haleon recruitment team will contact you using a Haleon email account (@haleon.com). If you are not sure whether the email you received is from Haleon, please get in touch.