Before medicine reaches a patient, it has to be developed, manufactured, released, and delivered, and every one of those steps now runs on digital systems. A ransomware attack at a supplier or a compromised production network can delay a batch long after the servers are back online. The five Swiss-based leaders below protect different links in that chain, from the ingredients that go into medicines to the pharmacies that hand them over the counter.
Franck Braunstedter – CISO, Bachem
Franck Braunstedter came back to pharma. After nearly eight years at NTT, where he rose to senior director of security consulting for Europe, he joined Bachem as CISO in May 2025, taking responsibility for security, compliance, and IT quality assurance at a company he describes as delivering critical components for medicines worldwide. His team works in a regulated pharmaceutical and OT environment at Bubendorf, where he has been recruiting for identity and access engineering. He knows the industry from the inside: over eight years at Actelion, he moved from project manager to IT security architect, team leader for information security, and finally head of global cyber security. Before pharma, he spent nearly seven years directing software development at SOLVIS, a background that still shapes his architecture-first approach to security.
Richard Kearney – Group CISO, Octapharma
Fifteen years at Johnson & Johnson, then three leading cybersecurity across EMEA for Kenvue. Richard Kearney brought that background to Octapharma, the maker of human-protein medicines, as Group CISO in June 2024, working from Zug. He is recognized for safeguarding operational technology and for risk management in manufacturing production environments, and has led security through steady-state, divestiture, and turnaround situations across pharmaceuticals, medical devices, and consumer goods. His certifications reflect that plant-floor focus, combining the industrial GICSP with CISSP, CISM, GCIH, and GSEC, and his specialties include the IEC 62443 standard for industrial automation security. In September 2026 he was a discussion leader at Evanta’s DACH CISO Inner Circle.
Jonathan Sinclair – Head of Cyber Resilience for Pharma Technical Operations, Roche
Treat the medicine value chain, not the individual system, as the unit of cyber resilience. That is the argument Jonathan Sinclair made in an article he co-authored for the World Economic Forum in August 2026. A restored application, he and his co-authors wrote, may still leave a plant unable to release a medicine if quality evidence is incomplete, so resilience has to be judged by whether medicines keep reaching patients during recovery. He works on exactly that problem at Roche, where he has led cybersecurity for Pharma Technical Operations since 2024 and became head of cyber resilience for the division in August 2026. Earlier, he pioneered Bristol Myers Squibb’s manufacturing security strategy across its global sites, built Novartis’s global security assurance services, and served as CISO of SOPHiA GENETICS. He sits on the steering committee of ManuSec Europe.
Philipp Krayenbuehl – CISO, Sandoz
When Sandoz became a newly independent, publicly listed company after its spin-off from Novartis, Philipp Krayenbuehl built its standalone CISO organization and operating model from the ground up. As global head of information security, resilience, and compliance and CISO since December 2022, he is accountable for cyber and information security risk across the generics and biosimilars group, from regulatory compliance to protecting data, IT, and manufacturing and OT, and advises the executive team and board on the threat landscape. Among the leaders he recruited during the separation was the head who built Sandoz’s security operations function. He arrived from 21 years at Swiss Re, where he progressed from project manager through risk and data governance roles to Group CISO and then chief security officer, responsible for both cyber and physical security.
Douglas Andrews – CISO, Galenica
Douglas Andrews started out as an electronic technician and Marine Security Guard in the US Marine Corps, and served for two decades in the Marine Forces Reserve as a data communications maintenance officer. He now works at the downstream end of the medicine chain. As CISO of Galenica since May 2023, he is responsible for information security across a Swiss healthcare services group of more than 8,000 employees, spanning pharmaceutical logistics, wholesale distribution, retail pharmacies, and healthcare services. Before Galenica, he spent 14 years at Aebi Schmidt Group, moving from IT systems management to information security manager and CISO. At the Global Cyber Conference in 2026, he joined a panel on how cyber, AI, and quantum risks fit into one longer-term strategy. He holds a master’s in information systems management from the University of Maryland and is pursuing a PhD in cybersecurity management.
Every Link in the Chain
Read in order, these five profiles trace the chain Sinclair describes: Bachem’s components, Octapharma’s and Roche’s production, Sandoz’s generics and biosimilars, and Galenica’s distribution and pharmacies. Each leader protects a different link, and a disruption at any one of them can reach the patient waiting at the end.
Discover more CISOs securing their organizations:
-
- Shared Defence: Cybersecurity Leaders Protecting Research and Education
- Protecting Member Trust: Cybersecurity Leaders Behind America’s Credit Unions
- On the Right Track: Europe’s Rail Cybersecurity Leaders to Watch
- Keeping Public Life Running: Europe’s Public-Trust Cyber Leaders to Watch
- Building the Profession: Europe’s Cyber Community Leaders to Watch
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.