Vice President, Information Security and Privacy
About the role
The Vice President of Information Security & Privacy reports directly to the Senior Vice President, Chief Information Security and Risk Officer (CISRO). This role leads and advances enterprise information security and privacy programs to protect information assets and manage privacy risks.
Responsibilities
Lead the implementation and continuous improvement of enterprise information security and privacy programs.
Direct and oversee information security operations, security engineering, governance, risk management, privacy, vulnerability management, incident response, threat intelligence, and data protection functions.
Develop, implement, and maintain security and privacy policies, standards, procedures, and control frameworks.
Partner with business, technology, legal, compliance, human resources, internal audit, and operational leaders to integrate security and privacy requirements.
Oversee the enterprise privacy program, including privacy impact and risk assessments, data protection requirements, regulatory compliance activities, privacy-by-design practices, and privacy incident management.
Create, communicate, and implement risk-based processes for third-party and vendor risk management.
Oversee security and privacy monitoring, incident response, investigations, and threat intelligence activities.
Monitor the evolving threat, regulatory, and privacy landscape and advise executive leadership on emerging risks and compliance obligations.
Develop and maintain program metrics, key performance indicators, dashboards, and executive reporting.
Collaborate with enterprise leaders to support business continuity, disaster recovery, data governance, and other risk-related initiatives.
Prepare and deliver presentations, strategic updates, and recommendations to executive leadership and other governance bodies.
Qualifications
Bachelor’s Degree in Business Administration or an Information Technology-related field required.
Master’s Degree a strong plus (MBA, Information Technology or Legal/Compliance related degree preferred).
Twelve (12) years of experience in a combination of information security, risk management, and IT related jobs required.
Ten (10) years of supervisory experience required.
Knowledge, Skills And Abilities (KSAs)
Proven experience leading enterprise information security and privacy programs.
Knowledge of applicable legal, regulatory, and industry requirements.
Knowledge of information security and privacy frameworks, standards, and leading practices.
Demonstrated ability to develop, implement, and mature security and privacy governance programs.
Excellent written and verbal communication, interpersonal, and collaboration skills.
Ability to build trusted relationships and influence stakeholders.
Poise and ability to act calmly, decisively, and effectively in high-pressure situations.
Strong analytical, critical thinking, and problem-solving skills.
Demonstrated ability to manage multiple priorities, initiatives, and projects.
Strong leadership, organizational, and team development skills.
Experience with strategic planning, financial management, budgeting, resource allocation, and project management.
Experience managing vendor relationships and third-party risk management activities.
High level of personal integrity and professionalism.
License, Certifications And Registrations
Professional security management certification, such as CISSP, CISM, CISA or similar credentials desired.
Physical Requirements/Working Conditions
Primary work environment is in a climate-controlled office setting.
May require travel to attend meetings, trade shows, and conferences.
Must be able to work in a fast-paced, high-demand environment.
Requires strength sufficient to lift, carry, push, pull or otherwise move objects up to 40 pounds occasionally.
Requires mobility sufficient to sit, walk, stoop, bend and kneel.
May be exposed to fumes or airborne particles including secondhand smoke.