AI Security and Data Protection Governance and Control, VP

State Street•Boston, MA

7d•Hybrid

About The Position

We are looking for a team leader to lead AI Security and Data Protection Governance and Controls, reporting to the Global Head of Data Protection. You will set the enterprise strategy and accountability model for secure, resilient, and responsible AI and data protection capabilities, translating emerging risk into business-aligned policies, standards, controls, investment priorities, and measurable outcomes. You will lead a multidisciplinary team and partner with senior leaders across Security, Technology, Risk, Compliance, Legal, Procurement, Internal Audit, and the business to embed security-by-design and scalable governance across enterprise platforms, applications, data, and third-party services. The team is part of Global Cybersecurity, a function vital to protecting the confidentiality, integrity, availability, and resilience of the firm's information and technology environment. This leadership role is accountable for anticipating AI, data, and emerging technology risks; establishing a consistent enterprise control posture; directing remediation and transformation priorities; and representing the program with executive leadership, clients, auditors, and regulators. The role will enable the organization to adopt AI and data-driven capabilities securely while maintaining regulatory readiness and sustainable risk reduction.

Requirements

Enterprise leadership experience spanning AI security, data protection, security architecture, cybersecurity governance, technology risk, and control transformation.
Ability to convert complex technical, regulatory, and emerging risks into clear enterprise strategy, policy, control requirements, funding priorities, and executive decisions.
Strong judgment in control design, assurance, exception management, risk acceptance, issue remediation, and regulatory engagement within a large, regulated organization.
Proven success leading senior teams and complex, cross-functional transformation programs with measurable outcomes, clear accountability, and sustained adoption.
Executive presence and influence across Security, Engineering, Infrastructure, Cloud, Application Development, Data, Risk, Legal, Procurement, Audit, and business leadership.
Data-driven, risk-based decision making with the ability to balance strategic direction, delivery urgency, regulatory obligations, and operational resilience.
Commitment to developing talent, simplifying governance, standardizing controls, and building scalable operating models.
Bachelor's degree in Information Security, Computer Science, Engineering, Mathematics, Data Science, or a related discipline; advanced degree preferred.
13+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance, including significant leadership responsibility in a large, complex organization.
Demonstrated experience leading managers and senior professionals, setting enterprise strategy, governing multi-year transformation, and influencing executive-level decisions.
Experience establishing enterprise policies, standards, and controls; directing cross-functional transformation; governing third-party risk; managing executive and regulatory relationships; and communicating complex risk to technical and non-technical audiences.
Ability to lead across global teams and time zones, support regulatory and audit engagements, manage sensitive information in accordance with company requirements, and provide executive coverage for critical program or risk matters.

Nice To Haves

CISSP, CISM, CRISC, CCSP, cloud security, privacy, AI governance, or comparable industry certifications preferred.
AI model and data discovery; data classification and protection; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and executive reporting or dashboard technologies.
Travel may be required based on business needs.

Responsibilities

Set the enterprise vision, strategy, governance model, and multi-year roadmap for AI security, data protection, and emerging technology risk.
Lead, develop, and retain a multidisciplinary team responsible for governance, control oversight, risk assessment, assurance, program execution, and stakeholder engagement.
Establish enterprise policies, standards, control objectives, decision rights, risk ownership, and accountability across AI models, data assets, applications, infrastructure, cloud, identity, networks, and third-party services.
Direct the discovery, inventory, classification, and risk assessment of AI models, sensitive data, security controls, platforms, integrations, and critical technology dependencies.
Approve risk-based prioritization criteria and investment decisions using data sensitivity, business criticality, external exposure, retention, control maturity, regulatory impact, and remediation complexity.
Sponsor minimum control requirements, testing and evidence standards, exception governance, compensating controls, risk acceptance, and remediation expectations across the enterprise.
Oversee the transition of vulnerable or noncompliant implementations to approved secure technologies and control solutions, including milestones, funding, dependencies, control gates, and executive escalation.
Partner with Security Architecture and Engineering leaders to embed AI security, data protection, security-by-design, and adaptable control requirements into architectures, engineering standards, and reusable implementation patterns.
Establish third-party AI security and data protection requirements for products, cloud services, strategic vendors, due diligence, contracts, and ongoing oversight.
Serve as the senior subject-matter authority for AI security and data protection governance in engagements with executive leadership, Risk, Compliance, Legal, Internal Audit, external auditors, clients, and regulators.
Define management reporting, key risk indicators, performance measures, and executive dashboards covering inventory, exposure, control compliance, exceptions, remediation, roadmap delivery, and residual risk.
Own program operating rhythm, resource planning, budget priorities, and cross-functional governance to drive timely decisions and measurable risk reduction.

Benefits

our retirement savings plan (401K) with company match
insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages
paid-time off including vacation, sick leave, short term disability, and family care responsibilities
access to our Employee Assistance Program
incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans)
eligibility for certain tax advantaged savings plans
inclusive development opportunities
flexible work-life support
paid volunteer days
vibrant employee networks