AI Security and Data Protection Governance and Controls VP
State Street · Berwyn, PA · 1 mo ago
$120k–$203k/yrFull-time
We need to output HTML fragment with sections: About the role? The posting includes "Who We Are Looking For", "Why this role is important to us", "What You Will Be Responsible For", "What We Value", "Education & Preferred Qualifications", "Additional Requirements", "Work Requirement", "Salary Range", "Benefits", "About State Street". Also maybe "Additional language requirements" but it's N/A, we should not include sections with filler. So we include sections that have real content.
We need to use for section headings. Use
for section headings. Use - for any list of duties/requirements/benefits, and
for prose.
We must not repeat job title as heading. No Job ID etc.
We must preserve all substantive info, not invent or summarize away detail. Remove boilerplate (EEO, legal, scam warning, application instructions). Also remove duplicated lines.
We need to decide which sections to include:
- About the role? The posting starts with "Who We Are Looking For". That could be considered "About the role". We'll use heading "About the role". Content: description of role: Vice President, AI Security and Data Protection Governance and Controls reporting to Managing Director, Data Protection. Establish and oversee enterprise governance framework... etc. That's a paragraph.
- Why this role is important to us: heading maybe "Why this role is important". Content paragraph.
- What You Will Be Responsible For: heading "Responsibilities". Then list bullet points from "In this role, you will:" each bullet.
- What We Value: heading "Skills" or "Qualifications"? The section "What We Value These skills will help you succeed in this role" includes bullet-like sentences but not list format. Could treat as
- each skill. We'll extract each sentence separated by periods? Better to treat as list items.
- Education & Preferred Qualifications: heading "Qualifications". Then list bullet points: Degree required..., Years of experience..., Certifications..., Knowledge of tools..., Additional language requirements: N/A (skip), Other qualifications: ... We'll include those with content.
- Additional Requirements: heading maybe "Additional Requirements". Content paragraph.
- Work Requirement: heading "Schedule". Content: Hybrid Work Requirement..., Shift Timings...
- Salary Range: heading "Pay". Content paragraph.
- Benefits: heading "Benefits". Content paragraph describing benefits.
- About State Street: heading maybe "About the Company". Content paragraph.
We must not include sections with filler like "Additional language requirements: N/A". So we skip that.
We must not include duplicated lines. Ensure we preserve all substantive info.
Let's extract content precisely.
I'll copy relevant parts.
"Who We Are Looking For We are looking for a Vice President, AI Security and Data Protection Governance and Controls reporting directly to the Managing Director, Data Protection. You will establish and oversee the enterprise governance framework for secure and resilient AI and data protection capabilities, translating strategy into policies, standards, controls, risk decisions, and measurable remediation programs. You will partner across Security, Technology, Risk, Compliance, Legal, Procurement, and the business to embed security-by-design, resilient controls, and adaptable technology standards and AI security and data protection requirements across enterprise platforms, applications, and third-party services."
That's the paragraph.
"Why this role is important to us The team you will be joining is part of Global Cybersecurity, a function vital to protecting the confidentiality, integrity, availability, and resilience of the firm’s information and technology environment. This role is critical to preparing the organization for emerging AI, data, and emerging technology risks, reducing long-term security and data protection risk, supporting regulatory and audit readiness, and coordinating a controlled transition to secure and resilient AI and data protection capabilities."
Paragraph.
"What You Will Be Responsible For In this role, you will: Establish and maintain the enterprise governance framework, policies, standards, decision rights, and accountability model for AI security, data protection, and emerging technology risk. Govern the discovery, inventory, classification, and risk assessment of AI models, data assets, security controls, platforms, applications, integrations, and technology dependencies. Define risk-based prioritization criteria using data sensitivity, retention period, business criticality, external exposure, and migration complexity, including long-term data exposure and emerging technology risk. Design minimum control requirements, testing procedures, evidence standards, exception processes, compensating controls, and remediation expectations across applications, infrastructure, cloud, networks, identity, and data platforms. Establish and oversee the enterprise roadmap for transitioning vulnerable security and data protection implementations to approved approved secure technologies and control solutions, including delivery milestones, control gates, dependencies, and risk escalation. Partner with Security Architecture and Engineering to embed AI security and data protection and security-by-design and adaptable control requirements into solution design, architecture reviews, engineering standards, and reusable implementation patterns. Define AI security and data protection requirements and due-diligence criteria for third-party products, cloud services, strategic vendors, contracts, and technology evaluations. Serve as the subject-matter authority for AI security and data protection governance in engagements with senior leadership, Risk, Compliance, Internal Audit, external auditors, clients, and regulators. Establish dashboards, key risk indicators, and performance measures for inventory coverage, AI and data risk exposure, control compliance, exceptions, migration progress, remediation, and residual risk. Lead and develop a team responsible for governance, control oversight, risk assessment, program coordination, and cross-functional execution."
We need to turn each sentence after colon into
- . Ensure we keep the content exactly.
Let's list them:
1. Establish and maintain the enterprise governance framework, policies, standards, decision rights, and accountability model for AI security, data protection, and emerging technology risk.
2. Govern the discovery, inventory, classification, and risk assessment of AI models, data assets, security controls, platforms, applications, integrations, and technology dependencies.
3. Define risk-based prioritization criteria using data sensitivity, retention period, business criticality, external exposure, and migration complexity, including long-term data exposure and emerging technology risk.
4. Design minimum control requirements, testing procedures, evidence standards, exception processes, compensating controls, and remediation expectations across applications, infrastructure, cloud, networks, identity, and data platforms.
5. Establish and oversee the enterprise roadmap for transitioning vulnerable security and data protection implementations to approved approved secure technologies and control solutions, including delivery milestones, control gates, dependencies, and risk escalation.
6. Partner with Security Architecture and Engineering to embed AI security and data protection and security-by-design and adaptable control requirements into solution design, architecture reviews, engineering standards, and reusable implementation patterns.
7. Define AI security and data protection requirements and due-diligence criteria for third-party products, cloud services, strategic vendors, contracts, and technology evaluations.
8. Serve as the subject-matter authority for AI security and data protection governance in engagements with senior leadership, Risk, Compliance, Internal Audit, external auditors, clients, and regulators.
9. Establish dashboards, key risk indicators, and performance measures for inventory coverage, AI and data risk exposure, control compliance, exceptions, migration progress, remediation, and residual risk.
10. Lead and develop a team responsible for governance, control oversight, risk assessment, program coordination, and cross-functional execution.
Note there is a duplicate "approved approved". We'll keep as is.
"What We Value These skills will help you succeed in this role Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, AI security and data protection, and security-by-design, resilient controls, and adaptable technology standards. Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions. Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization. Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability. Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams. Data-driven, risk-based decision making with strong attention to detail, strategic judgment, and a focus on sustainable risk reduction. Commitment to simplification, standardization, collaboration, and scalable governance."
We can turn each sentence into
- . Let's split by period after each sentence.
Sentences:
- Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, AI security and data protection, and security-by-design, resilient controls, and adaptable technology standards.
- Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions.
- Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization.
- Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability.
- Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams.
- Data-driven, risk-based decision making with strong attention to detail, strategic judgment, and a focus on sustainable risk reduction.
- Commitment to simplification, standardization, collaboration, and scalable governance.
Note first sentence repeats "AI security and data protection" twice; keep as is.
"Education & Preferred Qualifications Degree required: Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline; advanced degree preferred. Years of experience: 10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance. Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred. Knowledge of tools or technologies: Security and Data Protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies. Additional language requirements: N/A. Other qualifications: Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization."
We will skip the Additional language requirements line (N/A). We'll make list items for each bullet.
List items:
- Degree required: Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline; advanced degree preferred.
- Years of experience: 10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance.
- Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred.
- Knowledge of tools or technologies: Security and Data Protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies.
- Other qualifications: Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization.
"Additional Requirements Additional requirements for this role include the ability to coordinate across global teams and time zones, support regulatory and audit engagements as needed, and manage sensitive information in accordance with company requirements. Travel may be required based on business needs."
Paragraph.
"Work Requirement Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements. Shift Timings: Standard business hours with flexibility to support global stakeholders and critical program or regulatory needs."
We can make two list items or paragraph. Since it's structured as two items, we can list.
"Salary Range $120,000 - $202,500 Annual The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ."
Paragraph.
"Benefits Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and
for prose. We must not repeat job title as heading. No Job ID etc. We must preserve all substantive info, not invent or summarize away detail. Remove boilerplate (EEO, legal, scam warning, application instructions). Also remove duplicated lines. We need to decide which sections to include: - About the role? The posting starts with "Who We Are Looking For". That could be considered "About the role". We'll use heading "About the role". Content: description of role: Vice President, AI Security and Data Protection Governance and Controls reporting to Managing Director, Data Protection. Establish and oversee enterprise governance framework... etc. That's a paragraph. - Why this role is important to us: heading maybe "Why this role is important". Content paragraph. - What You Will Be Responsible For: heading "Responsibilities". Then list bullet points from "In this role, you will:" each bullet. - What We Value: heading "Skills" or "Qualifications"? The section "What We Value These skills will help you succeed in this role" includes bullet-like sentences but not list format. Could treat as
- each skill. We'll extract each sentence separated by periods? Better to treat as list items. - Education & Preferred Qualifications: heading "Qualifications". Then list bullet points: Degree required..., Years of experience..., Certifications..., Knowledge of tools..., Additional language requirements: N/A (skip), Other qualifications: ... We'll include those with content. - Additional Requirements: heading maybe "Additional Requirements". Content paragraph. - Work Requirement: heading "Schedule". Content: Hybrid Work Requirement..., Shift Timings... - Salary Range: heading "Pay". Content paragraph. - Benefits: heading "Benefits". Content paragraph describing benefits. - About State Street: heading maybe "About the Company". Content paragraph. We must not include sections with filler like "Additional language requirements: N/A". So we skip that. We must not include duplicated lines. Ensure we preserve all substantive info. Let's extract content precisely. I'll copy relevant parts. "Who We Are Looking For We are looking for a Vice President, AI Security and Data Protection Governance and Controls reporting directly to the Managing Director, Data Protection. You will establish and oversee the enterprise governance framework for secure and resilient AI and data protection capabilities, translating strategy into policies, standards, controls, risk decisions, and measurable remediation programs. You will partner across Security, Technology, Risk, Compliance, Legal, Procurement, and the business to embed security-by-design, resilient controls, and adaptable technology standards and AI security and data protection requirements across enterprise platforms, applications, and third-party services." That's the paragraph. "Why this role is important to us The team you will be joining is part of Global Cybersecurity, a function vital to protecting the confidentiality, integrity, availability, and resilience of the firm’s information and technology environment. This role is critical to preparing the organization for emerging AI, data, and emerging technology risks, reducing long-term security and data protection risk, supporting regulatory and audit readiness, and coordinating a controlled transition to secure and resilient AI and data protection capabilities." Paragraph. "What You Will Be Responsible For In this role, you will: Establish and maintain the enterprise governance framework, policies, standards, decision rights, and accountability model for AI security, data protection, and emerging technology risk. Govern the discovery, inventory, classification, and risk assessment of AI models, data assets, security controls, platforms, applications, integrations, and technology dependencies. Define risk-based prioritization criteria using data sensitivity, retention period, business criticality, external exposure, and migration complexity, including long-term data exposure and emerging technology risk. Design minimum control requirements, testing procedures, evidence standards, exception processes, compensating controls, and remediation expectations across applications, infrastructure, cloud, networks, identity, and data platforms. Establish and oversee the enterprise roadmap for transitioning vulnerable security and data protection implementations to approved approved secure technologies and control solutions, including delivery milestones, control gates, dependencies, and risk escalation. Partner with Security Architecture and Engineering to embed AI security and data protection and security-by-design and adaptable control requirements into solution design, architecture reviews, engineering standards, and reusable implementation patterns. Define AI security and data protection requirements and due-diligence criteria for third-party products, cloud services, strategic vendors, contracts, and technology evaluations. Serve as the subject-matter authority for AI security and data protection governance in engagements with senior leadership, Risk, Compliance, Internal Audit, external auditors, clients, and regulators. Establish dashboards, key risk indicators, and performance measures for inventory coverage, AI and data risk exposure, control compliance, exceptions, migration progress, remediation, and residual risk. Lead and develop a team responsible for governance, control oversight, risk assessment, program coordination, and cross-functional execution." We need to turn each sentence after colon into
- . Ensure we keep the content exactly. Let's list them: 1. Establish and maintain the enterprise governance framework, policies, standards, decision rights, and accountability model for AI security, data protection, and emerging technology risk. 2. Govern the discovery, inventory, classification, and risk assessment of AI models, data assets, security controls, platforms, applications, integrations, and technology dependencies. 3. Define risk-based prioritization criteria using data sensitivity, retention period, business criticality, external exposure, and migration complexity, including long-term data exposure and emerging technology risk. 4. Design minimum control requirements, testing procedures, evidence standards, exception processes, compensating controls, and remediation expectations across applications, infrastructure, cloud, networks, identity, and data platforms. 5. Establish and oversee the enterprise roadmap for transitioning vulnerable security and data protection implementations to approved approved secure technologies and control solutions, including delivery milestones, control gates, dependencies, and risk escalation. 6. Partner with Security Architecture and Engineering to embed AI security and data protection and security-by-design and adaptable control requirements into solution design, architecture reviews, engineering standards, and reusable implementation patterns. 7. Define AI security and data protection requirements and due-diligence criteria for third-party products, cloud services, strategic vendors, contracts, and technology evaluations. 8. Serve as the subject-matter authority for AI security and data protection governance in engagements with senior leadership, Risk, Compliance, Internal Audit, external auditors, clients, and regulators. 9. Establish dashboards, key risk indicators, and performance measures for inventory coverage, AI and data risk exposure, control compliance, exceptions, migration progress, remediation, and residual risk. 10. Lead and develop a team responsible for governance, control oversight, risk assessment, program coordination, and cross-functional execution. Note there is a duplicate "approved approved". We'll keep as is. "What We Value These skills will help you succeed in this role Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, AI security and data protection, and security-by-design, resilient controls, and adaptable technology standards. Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions. Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization. Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability. Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams. Data-driven, risk-based decision making with strong attention to detail, strategic judgment, and a focus on sustainable risk reduction. Commitment to simplification, standardization, collaboration, and scalable governance." We can turn each sentence into
- . Let's split by period after each sentence. Sentences: - Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, AI security and data protection, and security-by-design, resilient controls, and adaptable technology standards. - Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions. - Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization. - Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability. - Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams. - Data-driven, risk-based decision making with strong attention to detail, strategic judgment, and a focus on sustainable risk reduction. - Commitment to simplification, standardization, collaboration, and scalable governance. Note first sentence repeats "AI security and data protection" twice; keep as is. "Education & Preferred Qualifications Degree required: Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline; advanced degree preferred. Years of experience: 10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance. Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred. Knowledge of tools or technologies: Security and Data Protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies. Additional language requirements: N/A. Other qualifications: Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization." We will skip the Additional language requirements line (N/A). We'll make list items for each bullet. List items: - Degree required: Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline; advanced degree preferred. - Years of experience: 10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance. - Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred. - Knowledge of tools or technologies: Security and Data Protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies. - Other qualifications: Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization. "Additional Requirements Additional requirements for this role include the ability to coordinate across global teams and time zones, support regulatory and audit engagements as needed, and manage sensitive information in accordance with company requirements. Travel may be required based on business needs." Paragraph. "Work Requirement Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements. Shift Timings: Standard business hours with flexibility to support global stakeholders and critical program or regulatory needs." We can make two list items or paragraph. Since it's structured as two items, we can list. "Salary Range $120,000 - $202,500 Annual The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ." Paragraph. "Benefits Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and