AI Security and Data Protection Governance and Controls VP

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We need to parse the job posting. Key parts: - "Who We Are Looking For" is intro; maybe we can treat as About the role? The instruction: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to decide which sections we have content for. We have: - About the role: could be "Who We Are Looking For" and "Why this role is important to us". That's description. - Responsibilities: "What You Will Be Responsible For" with bullet list. - Requirements: maybe "What We Value" (skills) and "Education & Preferred Qualifications". Also "Additional Requirements". Could combine. - Qualifications: maybe "Education & Preferred Qualifications" and "Additional Requirements". - Skills: "What We Value" includes skills. - Benefits: "Employees are eligible to participate in State Street’s comprehensive benefits program..." includes benefits. - Pay: "Salary Range $120,000 - $202,500 Annual". That's pay. - Schedule: "Work Requirement Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements. Shift Timings: Standard business hours with flexibility to support global stakeholders and critical program or regulatory needs." That's schedule. We must not include filler like "N/A". Additional language requirements: N/A - we should not include that as a section; we can drop. We must not repeat job title as heading. Not include Job ID. We must remove boilerplate: EEO, legal, etc. Also remove "About State Street" maybe? It's not required but could be considered boilerplate? It's about company; but not required sections. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "About State Street" maybe not boilerplate but could be considered company description; but not required sections. It might be okay to keep as part of About the role? But we already have About the role content; we could incorporate some of that but not necessary. Safer to omit "About State Street" as it's not requested sections. However we must preserve ALL substantive information; but we can decide that "About State Street" is not substantive to the role? It's generic company info; but maybe considered boilerplate. The instruction says remove boilerplate; "About State Street" could be considered boilerplate. So we can drop it. Also "Discover more information on jobs at StateStreet.com/careers" etc - drop. "Job Application Disclosure" about lie detector test - drop. Now we need to produce HTML fragment with sections. We need to use

for each section heading, then content: either

for prose,

• for lists. We need to preserve all substantive information. Let's extract content. **About the role**: Combine "Who We Are Looking For" and "Why this role is important to us". Who We Are Looking For paragraph: "We are looking for a Vice President, AI Security and Data Protection Governance and Controls reporting directly to the Managing Director, Data Protection. You will establish and oversee the enterprise governance framework for secure and resilient AI and data protection capabilities, translating strategy into policies, standards, controls, risk decisions, and measurable remediation programs. You will partner across Security, Technology, Risk, Compliance, Legal, Procurement, and the business to embed security-by-design, resilient controls, and adaptable technology standards and AI security and data protection requirements across enterprise platforms, applications, and third-party services." Why this role is important to us paragraph: "The team you will be joining is part of Global Cybersecurity, a function vital to protecting the confidentiality, integrity, availability, and resilience of the firm’s information and technology environment. This role is critical to preparing the organization for emerging AI, data, and emerging technology risks, reducing long-term security and data protection risk, supporting regulatory and audit readiness, and coordinating a controlled transition to secure and resilient AI and data protection capabilities." We can combine into one or two paragraphs. Use

  for prose. **Responsibilities**: "What You Will Be Responsible For" includes a colon then bullet list starting with "In this role, you will:" then each bullet begins with a verb. We need to capture each bullet as

• . List items: - Establish and maintain the enterprise governance framework, policies, standards, decision rights, and accountability model for AI security, data protection, and emerging technology risk. - Govern the discovery, inventory, classification, and risk assessment of AI models, data assets, security controls, platforms, applications, integrations, and technology dependencies. - Define risk-based prioritization criteria using data sensitivity, retention period, business criticality, external exposure, and migration complexity, including long-term data exposure and emerging technology risk. - Design minimum control requirements, testing procedures, evidence standards, exception processes, compensating controls, and remediation expectations across applications, infrastructure, cloud, networks, identity, and data platforms. - Establish and oversee the enterprise roadmap for transitioning vulnerable security and data protection implementations to approved approved secure technologies and control solutions, including delivery milestones, control gates, dependencies, and risk escalation. - Partner with Security Architecture and Engineering to embed AI security and data protection and security-by-design and adaptable control requirements into solution design, architecture reviews, engineering standards, and reusable implementation patterns. - Define AI security and data protection requirements and due-diligence criteria for third-party products, cloud services, strategic vendors, contracts, and technology evaluations. - Serve as the subject-matter authority for AI security and data protection governance in engagements with senior leadership, Risk, Compliance, Internal Audit, external auditors, clients, and regulators. - Establish dashboards, key risk indicators, and performance measures for inventory coverage, AI and data risk exposure, control compliance, exceptions, migration progress, remediation, and residual risk. - Lead and develop a team responsible for governance, control oversight, risk assessment, program coordination, and cross-functional execution. Note there is a duplicate "approved approved". We'll keep as is. **Requirements / Qualifications / Skills**: We have "What We Value" (skills) and "Education & Preferred Qualifications" and "Additional Requirements". Also "Additional language requirements: N/A" (skip). Also "Other qualifications: Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization." We need to decide sections. Could have: - Skills: "What We Value" bullet list (though it's prose with commas). It says: "These skills will help you succeed in this role Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, AI security and data protection, and security-by-design, resilient controls, and adaptable technology standards. Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions. Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization. Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability. Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams. Data-driven, risk-based decision making with strong attention to detail, strategic judgment, and a focus on sustainable risk reduction. Commitment to simplification, standardization, collaboration, and scalable governance." We can turn each sentence into
• maybe. But it's not explicitly a list; but we can treat as list of skills. The instruction: Use
  • for any list of duties/requirements/benefits. This is a list of skills/requirements, so we can make
    • . - Qualifications: Education & Preferred Qualifications: "Degree required: Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline; advanced degree preferred. Years of experience: 10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance. Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred. Knowledge of tools or technologies: Security and Data Protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies." We can make
      • for each bullet? It's semicolon separated; we can split. - Additional Requirements: "Additional requirements for this role include the ability to coordinate across global teams and time zones, support regulatory and audit engagements as needed, and manage sensitive information in accordance with company requirements. Travel may be required based on business needs." We could include under Requirements or Qualifications. Maybe we create a section "Requirements" that includes Education & Preferred Qualifications, Additional Requirements, and maybe Other qualifications. But we also have "Other qualifications: Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization." That's also qualifications. We could combine all under a single "Qualifications" section with sub-bullets. But the instruction: Prefer a few substantive sections over many thin ones. So we could have sections: About the role, Responsibilities, Qualifications (covering education, experience, certifications, skills, other qualifications), Benefits, Pay, Schedule. Skills could be part of Qualifications. Thus we might not need separate Skills section. Let's decide: - About the role (h3) - Responsibilities (h3) - Qualifications (h3) - includes Education & Preferred Qualifications, Other qualifications, Additional requirements, Skills (What We Value) - Benefits (h3) - Pay (h3) - Schedule (h3) We must not include sections with filler like "N/A". Additional language requirements N/A we skip. Now we need to extract all substantive info for Qualifications. Let's list: Education & Preferred Qualifications: - Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline; advanced degree preferred. - 10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance. - Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred. - Knowledge of tools or technologies: Security and Data Protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies. Other qualifications: - Experience developing enterprise security policies, standards, and controls; - leading cross-functional transformation; - engaging vendors; - communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization. Additional requirements: - Ability to coordinate across global teams and time zones; - support regulatory and audit engagements as needed; - manage sensitive information in accordance with company requirements. - Travel may be required based on business needs. What We Value (skills): - Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, AI security and data protection, and security-by-design, resilient controls, and adaptable technology standards. - Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions. - Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization. - Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability. - Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams. - Data-driven, risk-based decision making with strong