Building a Global IT Organization: MedTech

August 1, 2025

The Role

A global MedTech manufacturer with 3,500+ employees across 30+ sites in 14 countries. I joined in 2010. By the time I left in 2025, I was running the entire global IT function: infrastructure, operations, security, service management, governance, and strategy. Multi-million euro annual budget. When I became Head of Corporate IT in 2019, it was still largely a local support function, and the business mostly noticed IT when something broke. The mandate was to turn it into a strategic global organization without stopping the machine.

What I Delivered

Global IT Organization

Scaled the team from a small local group to around 100 people across multiple countries. My role was to set the operating model, define what ownership meant at each level, and put the right leaders in place, not to manage every team directly. The model: decentralized delivery, centralized governance. Regional IT leads had clear accountability for their sites. Standards, security policy, architecture decisions, and vendor management were global. That tension (standardization versus local autonomy) was one I actively managed. You cannot run 30+ sites with 30 different approaches to endpoint management or backup strategy. But a one-size-fits-all model fails in practice across different countries, languages, and regulatory environments. The answer: standardize infrastructure and security. Localize support and user experience. And build leaders who could hold that line without constant escalation.

ISO 27001:2022 Certification

Served as executive sponsor for the ISO 27001:2022 certification program, a board-level commitment with direct regulatory implications for MedTech. Medical device regulations require demonstrable information security controls, and customers were increasingly demanding it during procurement. The organization had deep audit experience (ISO 9001, ISO 14001, cybersecurity frameworks), but no existing ISMS and no formal information security management discipline mapped to IT operations. The challenge was not introducing compliance culture from zero; it was translating an organization already fluent in quality and regulatory audit into a new domain with different ownership models, different evidence requirements, and a much broader IT surface area than any previous certification had touched. I set the mandate, secured the investment, and held accountability for scope and pace. My team did the build. I made the calls when cross-functional resistance needed to be resolved at the right level. We achieved certification on schedule. I also sponsored UK Cyber Essentials and CyberTrust Gold Label certification.

Infrastructure & Service Management

Set the strategic direction for infrastructure modernization across the global footprint: network architecture, data center operations, cloud migration, endpoint management, and collaboration platforms. Replaced legacy environments that had grown organically for years with coherent, managed, and documented infrastructure. Established security operations (vulnerability management, threat detection, and incident response) and built service management from repurposed project tooling into a proper ITSM function with SLAs, a CMDB, and reporting the business could actually use. Managed a €15M+ annual investment portfolio. Every major initiative had a board-approved business case built around cost, risk, timeline, and ROI. Not IT spending for IT's sake, but investment framed against business outcomes.

What Made It Hard

The hardest part was not technical: it was organizational change at scale, across cultures. Getting 30+ sites to treat centralized security standards as shared protection rather than headquarters overreach is a political problem as much as a governance one. You cannot solve that with policy documents alone. In MedTech, every IT decision lands in a context shaped by clinical outcomes, regulatory compliance, and market access. Translating infrastructure risk into that language ("this is what an outage on December 15th costs us in production downtime and regulatory exposure") was a constant discipline, not a one-time effort. The ISO 27001 program covered a defined product scope, but getting the organization ready to support it was a much larger problem. In a MedTech company that has grown over decades through acquisition and organic expansion, the baseline is never a clean slate: processes and asset ownership had grown organically, and much of the IT surface had never operated under formal information security requirements. Making IT audit-ready meant first making IT legible: to itself, to auditors, and to the business functions it depended on. That was the harder part of the mandate. Scaling a global team while maintaining a coherent culture does not happen through process alone. It requires deliberate investment in people, clear career paths, and leaders in every region who embody the standards you set. Trust and delegation are the actual infrastructure.

The Outcome

ISO 27001:2022 certified on schedule, alongside UK Cyber Essentials and CyberTrust Gold Label
Mean time to resolution down 11%, even as ticket volume kept growing in the single digits year over year; the organization scaled faster than the demand on it
A €15M+ annual investment portfolio run entirely on board-approved business cases
A local support function became a ~100-person global organization across 14 countries, with regional leaders who hold the standard without constant escalation