Who we are looking forWe are looking for a Data Protection Managing Director reporting directly to the SVP of Data and AI Security. The Managing Director, Data Protection is a senior leadership role responsible for defining, governing, and scaling the firm's enterprise-wide data protection strategy. This leader will establish a modern, risk-based data security program that enables the organization's digital, cloud, AI, and data transformation objectives while protecting the firm's most critical information assets. The role requires a visionary security leader who can balance business enablement with strong security outcomes. The successful candidate will drive the evolution from traditional data protection approaches toward a modern, intelligence-driven program focused on data discovery, classification, retention, access governance, AI security, and automated protection controls.
The Managing Director will serve as the firm's foremost authority on data security and protection, partnering across Security, Engineering, Data, Privacy, Legal, Risk, Compliance, Infrastructure, and Business teams to ensure security is embedded into platforms, pipelines, governance frameworks, and delivery processes.
What you will be responsible for - Define and execute the firm's multi-year Enterprise Data Protection Strategy, ensuring alignment with business priorities, regulatory obligations, cloud transformation initiatives, and AI adoption.
- Establish a comprehensive framework for protecting sensitive information throughout its lifecycle, including:
- Encryption and key management
- Monitoring and protection controls
- Drive a modern security model focused on protecting data regardless of location, platform, user, or technology stack.
- Develop executive-level metrics and reporting that quantify data risk, control effectiveness, and remediation progress.
- Lead enterprise initiatives to know, understand, and reduce data risk at scale.
- Establish programs to identify and continuously inventory:
- Sensitive customer and firm data
- Regulated and restricted information
- Create risk-based approaches to classify, prioritize, and remediate high-risk data concentrations across on-premises, cloud, SaaS, and emerging AI environments.
- Develop actionable intelligence that enables business leaders and technology teams to understand where sensitive data resides and how it is exposed.
- AI Data security & Protection - Lead the firm's strategy for protecting data from emerging AI-related threats and misuse.
- Establish controls and protections against:
- Data leakage through AI systems
- Retrieval-augmented generation (RAG) data exposure
- AI-enabled social engineering
- Partner closely with AI, Engineering, and Security Architecture teams to ensure AI capabilities are deployed using:
- Secure-by-default configurations
- Enterprise-approved AI platforms
- Develop data protection requirements for AI models, agents, copilots, and emerging autonomous systems.
- Establish rigorous enterprise-wide data lifecycle management and retention programs designed to minimize unnecessary data exposure.
- Eliminate obsolete and redundant data
- Reduce data longevity where business value no longer exists
- Improve defensibility and regulatory compliance
- Reduce attack surface through data minimization
- Partner with Legal, Compliance, Privacy, and business stakeholders to implement practical retention schedules and automated disposal capabilities.
- Ensure retention policies are enforced through technology controls rather than manual processes whenever possible.
- Data Access Governance - Lead enterprise efforts to analyze, govern, and continuously monitor access to sensitive information.
- Data-centric access control models
- Risk-based authorization frameworks
- Privileged access controls
- Continuous entitlement reviews
- Excessive permissions identification
- Partner with Identity and Access Management teams to strengthen least-privilege principles across business and technology environments.
- Ensure access decisions are informed by data sensitivity, business context, user risk, and regulatory requirements.
- Establish a comprehensive view of the firm's data protection control environment.
- Conduct enterprise-wide assessments to:
- Measure control effectiveness
- Prioritize remediation activities
- Develop risk-based roadmaps that focus resources on the most significant data protection exposures.
- Drive accountability across technology and business stakeholders to ensure timely remediation of material risks.
- Partner closely with the Data organization to ensure security is embedded throughout the data ecosystem.
- Promote security-by-design principles that enable innovation while reducing operational friction.
- Establish scalable security patterns that integrate directly into engineering workflows, automation pipelines, and platform services.
- Lead strategic modernization initiatives supporting the future state of data security.
- Drive improvements across:
- Enterprise encryption programs
- Machine identity controls
- Partner with Infrastructure, Cloud Engineering, and Enterprise Architecture teams to strengthen cryptographic hygiene and reduce operational risk.
- Develop forward-looking strategies that support emerging technology requirements and evolving regulatory expectations.
- Ensure data protection capabilities align with applicable regulatory and industry expectations, including:
- Serve as the executive leader for data protection reviews involving regulators, auditors, clients, and control assurance functions.
- Provide defensible and transparent reporting on the firm's data protection posture and remediation activities.
What we value These skills will help you succeed in this role:
- Executive Leadership & Stakeholder Engagement - Serve as a trusted advisor to executive leadership, including the CISO, CIO, CDO, Risk leadership, and business executives.
- Translate complex technical and data risks into clear business decisions and investment priorities.
- Build strong partnerships across Security, Technology, Data, Legal, Privacy, Compliance, and Risk organizations.
- Champion a culture where protecting sensitive data is viewed as a business imperative rather than a compliance exercise.
- Team Leadership & Development - Build and lead a high-performing global Data Protection organization.
- Develop teams responsible for:
- Data Security Engineering
- Data Discovery & Classification
- Encryption & Key Management
- Mentor future leaders and establish a culture focused on innovation, accountability, automation, and measurable outcomes.
- Recognized leader in Data Security and Data Protection.
- Strategic thinker with the ability to execute and deliver measurable outcomes.
- Strong business acumen and executive presence.
- Deep understanding of modern cloud, AI, and data architectures.
- Passion for automation, scale, and simplification.
- Ability to influence organizational boundaries and drive enterprise-wide change.
- Data-driven decision maker with strong risk management instincts.
- Customer-first mindset focused on trust, resilience, and protection of critical information assets.
Education and Preferred Qualifications - Bachelor's degree in Information Security, Computer Science, Engineering, Data Science, or related discipline.
- Advanced degree preferred.
- Relevant certifications such as CISSP, CISM, CCSP, CDPSE, or cloud security certifications strongly preferred.
- 15+ years of progressive leadership experience in cybersecurity, data protection, data security, or related disciplines.
- Demonstrated success leading enterprise-scale data protection programs within large, highly regulated organizations.
- Deep expertise in data discovery, classification, DLP, encryption, key management, data governance, and access controls.
- Proven experience securing cloud-native data ecosystems and modern data platforms.
- Strong understanding of AI security risks and data protection requirements associated with GenAI and AI-enabled business processes.
- Experience partnering with Data, Engineering, Privacy, Legal, Compliance, and Risk organizations.
- Track record of driving large-scale transformation and modernization initiatives.
- Experience presenting to executive leadership, boards, regulators, and auditors.
What we offer - Opportunity to define and lead the enterprise data protection strategy for a global systemically important financial institution.
- Executive-level visibility and influence across Security, Technology, and Data organizations.
- Direct impact on the firm's AI, cloud, and data transformation journey.
- Competitive compensation and comprehensive benefits.
- Collaborative culture focused on innovation, engineering excellence, and client trust.
Salary Range: $170,000 - $282,500 Annual
The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.
Employees are eligible to participate in State Street's comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.
For a full overview, visit https://hrportal.ehr.com/statestreet/Home.
