Cybersecurity Director – Data Protection, Security Architecture & Third-Party Risk

• Reporting line & scope Reports to: CISO
• Data Protection (classification, DLP, encryption, data handling rules, monitoring/response workflows) across endpoint, cloud, and on-prem.(2)
• Security Architecture (enterprise security architecture blueprint, patterns/standards, architecture reviews for new technologies).
• Third-Party Cyber Risk (vendor security due diligence, ongoing monitoring, security addendum/contract requirements, exception governance).
• 3rd Party Cyber Incident Response (operational oversight/enablement; define requirements, playbooks, testing, coordination across teams and vendors).
• Establish a sustainable classification approach (e.g., small, understandable taxonomy tied to handling expectations and controls) and ensure governance/ownership remains active over time.
• Implement a phased enforcement approach for DLP (visibility → user education → controlled override → targeted enforcement) to reduce false positives and operational friction.
• Define exception processes, review cadence, and tuning workflows so data protection does not become “set-and-forget” shelfware.
• Partner with IT, risk, privacy, legal, compliance, and business data owners to align protection controls to real data flows and regulatory expectations.
• Security architecture leadership Lead a team of security architects responsible for the security architecture blueprint , including reference architectures, control standards, and reusable patterns.
• Run architecture reviews for new technologies and major changes, ensuring security requirements are measurable and implementable (and exceptions are formally governed).
• Ensure security architecture integrates with enterprise platforms (IAM, logging/monitoring, endpoint security, cloud controls) and supports delivery velocity with clear guardrails.
• Third-party cyber risk management & due diligence Own the end-to-end vendor security assessment lifecycle: intake, risk tiering, due diligence, remediation tracking, risk acceptance, and renewal/continuous monitoring.
• Establish/maintain a standardized third-party security addendum and baseline contractual security requirements (with deviations handled via a formal, risk-based exception process).
• Ensure vendor security requirements are specific and enforceable (e.g., defined incident reporting timelines, audit rights, and consequences of non-compliance).
• Ensure contractual obligations support response needs (e.g., notification windows, root-cause analysis and corrective action expectations for vendors).
• Bachelor s degree in Information Security, Information Technology, Computer Science, Engineering or related field
• 10 years in information security, including leadership over at least two of: data protection/DLP, security architecture, third-party risk, incident response.
• Experience building governance-driven security programs that balance control enforcement with operational adoption.
• Demonstrated ability to create measurable, enforceable vendor security requirements and manage exceptions via risk-based governance.
• Experience operationalizing vendor risk lifecycle activities (tiering, due diligence, remediation, acceptance, continuous monitoring).
• Strong stakeholder management across legal, privacy, compliance, IT, procurement, and business leadership.
• Experience implementing a sustainable data protection model (labels/classification DLP tuning and rollout).
• Experience managing 3rd party cybersecurity risk program including due diligence, contract language, ongoing monitoring, and incident response.

None flagged.