Control COE Lead

Welcome to Haleon. We’re a purpose-driven, world-class consumer company putting everyday health in the hands of millions. In just three years since our launch, we’ve grown, evolved and are now entering an exciting new chapter – one filled with bold ambitions and enormous opportunity.

Our trusted portfolio of brands – including Sensodyne®, Panadol®, Advil®, Voltaren®, Theraflu®, Otrivin®, and Centrum® – lead in resilient and growing categories. What sets us apart is our unique blend of deep human understanding and trusted science.

Now it’s time to fully realise the full potential of our business and our people. We do this through our Win as One strategy. It puts our purpose – to deliver better everyday health with humanity – at the heart of everything we do. It unites us, inspires us, and challenges us to be better every day, driven by our agile, performance-focused culture.

About the role

The Control COE Lead is responsible for developing, governing, and continuously improving the enterprise-wide control framework within Digital & Technology. The role leads the design, simplification, automation, standardisation, and rationalisation of controls across D&T, ensuring the control environment is efficient, modern, risk‑based, and aligned to regulatory, audit, and operational expectations.

The role oversees the definition of control standards, patterns, and reusable frameworks and works with control owners, product teams, architects, engineering, and compliance stakeholders to embed high-quality, sustainable control designs. The Control COE Lead drives automation opportunities across the control lifecycle, including preventative controls, detective controls, continuous monitoring, and digital evidence collection.

As a central authority for control excellence, the role ensures alignment across SOx, ITGC, cybersecurity, privacy, GxP and other compliance domains, reducing duplication, improving efficiency, and enabling a scalable, tech‑enabled control environment.

Role Responsibilities

• Lead the enterprise-wide redesign, simplification, and optimisation of the D&T control environment, including control mapping, duplication elimination, standardisation, and creation of reusable design patterns.

• Define and maintain D&T control standards, methodologies, and frameworks, ensuring alignment with SOx, ITGC, cybersecurity, and privacy control expectations.

• Drive automation of controls and evidence collection, partnering with engineering, automation teams, and GRC tooling teams to enable continuous monitoring, preventative controls, and tech‑enabled assurance

• Oversee the rationalisation of existing controls, including removal of redundant or ineffective controls, consolidation of overlapping controls, and replacement of manual processes with automated solutions.

• Provide expert advisory support to control owners, product teams, architects, and risk & compliance, ensuring new solutions and technology changes embed “compliance by design” and adopt approved control patterns.

• Lead continuous improvement initiatives across the control lifecycle, measuring control effectiveness, identifying systemic issues, and coordinating enhancements with senior stakeholders and cross‑functional teams.

Business Expertise

• Requires deep understanding of technology risk, SOx, ITGC, cybersecurity control frameworks, and GxP expectations, including how these apply to modern cloud, data, infrastructure, and product environments.

• Strong knowledge of control design principles, process optimisation, automation capabilities, and industry best practices for controls engineering.

• Ability to translate regulatory requirements (SOx, GxP, privacy, cybersecurity) into actionable, scalable, technology‑friendly controls.

• Broad understanding of modern digital architecture (cloud, identity, data, DevOps), enabling effective collaboration with engineering and architecture teams on embedding automated controls.

• Commercially aware with ability to prioritise control optimisation activities that drive the biggest impact on risk reduction, cost reduction, audit readiness, and operational efficiency.

Problem Solving

• Tackles highly complex challenges relating to inconsistent control design, legacy processes, and fragmented control ownership across D&T.

• Requires ability to evaluate root causes, identify structural issues, and propose scalable and simplified solutions that balance risk, audit needs, regulatory expectations, and business agility.

• Must innovate by introducing automation, continuous monitoring, control-as-code, and modern assurance methods.

• Challenges compounded by evolving regulatory requirements (SOx, cybersecurity), continuous technology changes, and differing levels of maturity across teams.

• Requires structured judgement to redesign controls that are both audit‑ready and aligned to modern technology delivery practices (agile, DevSecOps, product‑centric operating models).

Interactions / Interpersonal Skills

• Extensive engagement with control owners, engineers, architects, product leaders, security teams, risk & compliance, internal audit, quality (for GxP systems), and external auditors.

• Requires strong communication and stakeholder management skills to explain complex control redesign concepts in clear, simple terms suitable for both technical and business audiences.

• Must influence decision-making without direct authority, particularly when simplifying long‑standing legacy control processes.

• Skilled in negotiation, conflict resolution, and driving adoption of new standards across diverse teams and geographies.

Skills Qualifications

• Degree or equivalent professional experience in Information Systems, Risk Management, Business, or a related discipline

• At least 15+ years of experience in IT compliance, auditing, or risk management

• Experience in technology risk management, control design, or control operations.

• Hands-on experience with SOx, ITGC, cy