Data Security Director

We need to output HTML fragment with sections: About Us? The instruction: Use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). They gave examples but we can use other headings if appropriate? They said use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should use those headings if content exists. The posting includes "About Us" (company description). Could map to "About the role"? Actually "About Us" is about company, not role. But we could still use "About the role" heading for role description? The job description includes responsibilities etc. We need to include sections only when posting has real specific content. We have content: Job Description (list of duties). Duties and Responsibilities (list). Job Specifications (required, preferred, education). Measures of Success (maybe could be considered as "Goals" but not in list). Work Environment, Supervisory/Responsibility, Travel. Benefits, Pay, Schedule not present. So we should not create those sections. We need to use

for section headings. Likely headings: About the role (maybe combine About Us and Job Description?), Responsibilities, Requirements, Qualifications, Skills. But we need to map content appropriately. We have "About Us" describing company. Could be placed under a heading like "About the company" but not in list. However instruction says use those examples but not limited? It says use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It implies we should use those headings when applicable. If we have content about the role, we can use "About the role". For responsibilities, use "Responsibilities". For requirements, use "Requirements". For qualifications, use "Qualifications". For skills, use "Skills". We need to decide what content goes where. We have: - About Us (company overview) maybe could go under "About the role"? Not exactly but could be considered background. Might be okay. - Job Description: The Data Security Director will: (list of bullet-like sentences). That's responsibilities. - Duties and Responsibilities: (another list). Could combine with responsibilities. - Job Specifications: Required, Preferred, Education, Business Systems Knowledge, Measures of Success. - Work Environment, Supervisory/Responsibility, Travel. We need to preserve all substantive information. So we need to include all those details. We can structure:

About the role

About Us: Barry-Wehmiller is a diversified global supplier ...

Job Description: The Data Security Director will: ...

But we should not repeat job title as heading. Already not. Then

Responsibilities

with

• items from Duties and Responsibilities (and maybe also from Job Description bullet list). We need to combine. Then

  Requirements

  with required qualifications: Minimum of 10 years..., Expert level..., Working knowledge..., Experience..., Strong knowledge..., Well-developed..., Strong change..., Ability..., Ability..., Ability... Then

  Qualifications

  with Preferred items and Education and Business Systems Knowledge? Actually Education could be under Qualifications. Business Systems Knowledge maybe under Skills? Or Qualifications. Then

  Skills

  maybe include interpersonal skills, change management, etc. But we already have some in Requirements. Might be redundant. Better: Use Requirements for required experience/knowledge; Qualifications for preferred certifications, education, business systems knowledge; Skills for interpersonal, change management, etc. Measures of Success could be its own section? Not in list but could be "Goals". But instruction says only include sections when posting has real specific content for it — we could create a custom heading? The examples are not exhaustive; they said e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. It doesn't forbid other headings, but says use

  for section headings (e.g. those). Likely we should stick to those headings; but we can also add other headings if needed? Safer to stick to those. We could put Measures of Success under "Responsibilities" or "Qualifications"? Not ideal. Maybe we can create a section "Goals" but not in examples; risk of being considered not following instruction. Better to incorporate into Responsibilities or Qualifications as a list. Work Environment, Supervisory/Responsibility, Travel could be placed under a section like "Work Details" but not in list. Could incorporate into Responsibilities? Not exactly. We could create a section "Details" but again not in examples. Given instruction: "Use

  for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It suggests those are typical but not exclusive. However they also say "Prefer a few substantive sections over many thin ones." So we can combine. Thus we can have sections: About the role, Responsibilities, Requirements, Qualifications, Skills. We'll embed all other details within these sections appropriately. Let's draft:

  About the role

  Barry-Wehmiller is a diversified global supplier of engineering consulting and manufacturing technology for the packaging, corrugating, sheeting and paper-converting industries. By blending people-centric leadership with disciplined operational strategies and purpose-driven growth, Barry-Wehmiller has become a $3 billion organization with nearly 12,000 team members united by a common belief: to use the power of business to build a better world.

  The Data Security Director will serve as the subject matter expert responsible for building good governance systems and controls to ensure the protection of BW’s unstructured data (including documents, email, chat and Teams content, file shares, endpoint and cloud-stored files, and engineering and design files such as CAD drawings). Protection of structured data is the responsibility of BW’s Business Insights team. The role includes advising the BW Board of Directors, Senior Leadership Team, IT Leadership Team, and colleagues on data security matters, engaging with data owners and processors to operationalize controls, and promoting good data protection practice across the organization.

  Responsibilities

  • Develop, implement, and maintain BW’s Data Security program coordinating across all IT and business functions to ensure a robust approach to securing data and ensuring business continuity.
  • Collaborate with other functional areas, departments, platforms, and divisions to maintain records of all data assets, storage, access, exports, etc., and maintain a data security incident management plan for timely remediation of incidents impacting critical data, including impact assessments, breach response, complaints, claims, or notifications.
  • Define, set, and oversee implementation of the BW data loss prevention strategy; actively manage policies, implement data privacy and loss controls, and supporting standards to ensure compliance with data privacy laws in all relevant jurisdictions, working closely with the BW Group Data Protection Officer.
  • Support investigations into data breaches, monitor remedial actions and lessons learned to avoid future breaches and mitigate business risks.
  • Ensure appropriate governance, business processes, and controls are in place to manage data security in alignment with BW’s risk appetite.
  • Establish metrics and periodic control testing to evaluate the effectiveness of BW’s data security program, and report results, exceptions, and risk trends to the Chief Information Security Officer and the IT Leadership Team.
  • Partner with the BW Group Data Protection Officer on employee training and awareness programs covering the importance of protecting sensitive data and compliance with BW’s data protection policies and procedures; support the Group Data Protection Officer in responding to external authorities and regulatory bodies on data protection matters.
  • Engage with the Business Insights (structured data) team to ensure consistent development and application of policies and regulatory compliance.
  • Establish and maintain governance for the use of BW data in artificial intelligence and generative AI tools, including Microsoft 365 Copilot and Claude Enterprise—covering content oversharing and permission hygiene, sensitivity labeling, acceptable‑use standards, and identification and control of unsanctioned (“shadow”) AI use.
  • Lead the identification, classification, and protection of BW’s intellectual property and trade secrets held as unstructured content — including engineering drawings, CAD and design files, process documentation, and proprietary machine designs — with particular attention to content shared externally with customers, suppliers, and partners.
  • Design and operate BW’s insider risk program for unstructured data, including monitoring for anomalous data movement, departing‑employee data exfiltration, and misuse of privileged access, working in coordination with the People Team, Legal, and the Group Data Protection Officer.
  • Assess the data security posture of acquired companies during due diligence and integration, and bring their unstructured data estates under BW’s classification, retention, and data loss prevention controls.
  • Lead, coach, and develop the data security team, setting clear priorities and growing the team’s capability in keeping with BW’s Truly Human Leadership philosophy.

  Requirements

  • Minimum of 10 years of progressive experience in data security, information security, or data protection, including at least 3 years leading and developing a team.
  • Expert level experience and knowledge of data loss prevention and protection technologies, including experience designing, deploying, and tuning DLP policies in a large enterprise environment.
  • Working knowledge of Microsoft Purview data security and governance capabilities (sensitivity labels, data loss prevention, insider risk management, and data lifecycle management), and with Entra ID and conditional access as they apply to protecting content.
  • Working knowledge of the practical application of privacy and data protection regulations, including the GDPR and the CCPA, and familiarity with the broader landscape of international and US state privacy laws.
  • Experience in developing policy and compliance training.
  • Experience with and knowledge of data governance.
  • Strong knowledge of information technology and data management systems.
  • Well‑developed and professional interpersonal skills; ability to interact effectively with people at all organizational levels of the business and external bodies.
  • Strong change and project management skills, including the ability to manage time well, prioritize effectively, and manage multiple competing deadlines.
  • Ability to manage confidential and sensitive information with appropriate discretion.
  • Ability to translate technical data security risk into business terms, and the credibility to advise senior leadership and the Board of Directors.

  Qualifications

  • Preferred: One or more information security certifications, such as CISSP, CISM, CCSP, or the Microsoft Information Security Administrator certification (SC‑401).
  • Preferred: A data protection or privacy certification, such as CIPP, CIPT, or CIPM.
  • Preferred: Experience in global manufacturing and in cross‑border data protection issues.
  • Preferred: Experience within a compliance, audit and/or risk function, with recent experience in privacy compliance and wider broad‑spectrum compliance programs.
  • Preferred: Experience protecting data across a decentralized, multi‑company environment, including integrating newly acquired businesses.
  • Education: Bachelor’s degree in computer science, information systems, cybersecurity, or a related field; an equivalent combination of education and relevant experience will be considered.
  • Business Systems Knowledge: Conceptual knowledge of business systems as ERP, PLM, CRM, CPQ, and Service Desk Management; conceptual knowledge of Security Service Edge systems (SSE); working knowledge of the M365 environment (SharePoint, Teams, OneDrive) and how content is stored, shared, and permissioned within it; proficiency with Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Power BI).
  • Measures of Success in the First 12 Months: A