Entity: Corporate Services Department: IS - CybersecurityLocation: 3535 Market Street/HybridSummary:The Senior Director, Cybersecurity Data & Application Security reports to the Chief Information Security Officer (CISO) and provides strategic, operational, and organizational leadership for Penn Medicine's enterprise Data Security and Application Security programs.
The role is responsible for protecting Penn Medicine's most critical information assets, applications, APIs, software development environments, databases, data platforms, and digital services through the development and execution of enterprise security strategies, governance frameworks, architecture standards, engineering capabilities, and operational controls.
This position serves as the enterprise authority for Data Security, Application Security, DevSecOps, Software Supply Chain Security, API Security, Database Security, Secure Development Practices, and Data Protection Engineering. The Senior Director partners closely with Information Services, Enterprise Architecture, Application Development, Data & Analytics, Cloud, Privacy, Compliance, Research, and Clinical Operations leaders to enable innovation while reducing organizational cyber risk.
The Senior Director leads teams responsible for application security, secure software development, DevSecOps, software supply chain security, API security, data protection engineering, database security, data security architecture, security testing, code assurance, and emerging digital security capabilities
Responsibilities:- Lead a highly experienced team of application security professionals, data security specialists, and cybersecurity experts responsible for enterprise data and application security capabilities.
- Develop and execute Penn Medicine's enterprise Data Security and Application Security strategy, operating model, governance framework, and multi-year roadmap.
- Lead security architecture reviews, threat modeling, and security design consultations supporting application development, cloud initiatives, data platforms, digital transformation projects, and emerging technology implementations.
- Oversee the implementation and operation of enterprise application security, data security, API security, database security, and software assurance capabilities.
- Establish enterprise policies, standards, architectures, and control frameworks governing data protection, secure software development, API security, software supply chain security, and application security practices.
- Establish and mature secure software development lifecycle (SSDLC) practices, DevSecOps methodologies, software security standards, and security-by-design principles across the organization.
- Lead application security testing programs including SAST, DAST, SCA, IAST, API testing, penetration testing coordination, code review, and software supply chain risk management activities.
- Develop and implement enterprise data protection strategies including data discovery, classification, encryption, tokenization, key management, database security, data loss prevention, and protection of sensitive clinical, research, financial, and business information.
- Establish governance and security controls protecting structured and unstructured data across on-premises, cloud, SaaS, analytics, research, and AI environments.
- Support modernization efforts that improve visibility, reduce manual work, standardize security control deployment, and enable faster execution of cybersecurity priorities.
- Lead software supply chain security initiatives including open-source security, third-party component risk management, CI/CD pipeline security, artifact integrity, and secure code delivery processes.
- Partner with Application Development, Cloud Security, Infrastructure, IAM, Architecture, Privacy, Compliance, and Data Governance teams to reduce risk and strengthen security posture across digital assets and information ecosystems.
- Lead, mentor, and develop cybersecurity engineering and operations staff through workforce planning, coaching, performance management, succession planning, and skills development.
- Provide coaching and mentorship to nurture the development of staff in line with organization's mission and values.
- Build organizational readiness to absorb future cybersecurity engineering capabilities, including identity security engineering, data protection technologies, cloud security platforms, AI security controls, and other emerging protection services as assigned.
- Performs duties in accordance with Penn Medicine and entity values, policies, and procedures.
- Other duties as assigned to support the unit, department, entity, and health system organization.
Education or Equivalent Experience:- Bachelor's degree is required.
- 12+ years of IT experience is required.
- 7+ years of Cybersecurity experience is required.
- Master's degree or 7+ years Management/leadership experience is preferred.
- 10+ years of Cybersecurity experience is preferred.
We believe that the best care for our patients starts with the best care for our employees. Our employee benefits programs help our employees get healthy and stay healthy. We offer a comprehensive compensation and benefits program that includes one of the finest prepaid tuition assistance programs in the region. Penn Medicine employees are actively engaged and committed to our mission. Together we will continue to make medical advances that help people live longer, healthier lives.
Live Your Life's Work
