AI Security and Data Protection Governance and Controls MD

State Street•Princeton, NJ

3d•$170,000 - $282,500•Hybrid

About The Position

State Street is seeking a Vice President, AI Security and Data Protection Governance and Controls, reporting directly to the Managing Director, Data Protection. The role will establish and oversee the enterprise governance framework for secure and resilient AI and data protection capabilities, translating strategy into policies, standards, controls, risk decisions, and measurable remediation programs. It will partner across Security, Technology, Risk, Compliance, Legal, Procurement, and business teams to embed security-by-design, resilient controls, adaptable technology standards, and AI security and data protection requirements across enterprise platforms, applications, and third-party services. This position is part of Global Cybersecurity and is important to protecting the confidentiality, integrity, availability, and resilience of the firm’s information and technology environment. It will help prepare the organization for emerging AI, data, and technology risks, reduce long-term security and data protection risk, support regulatory and audit readiness, and coordinate a controlled transition to secure and resilient AI and data protection capabilities. The position requires coordination across global teams and time zones, support for regulatory and audit engagements as needed, and handling sensitive information in accordance with company requirements. Travel may be required based on business needs. The role is hybrid, subject to company and location-specific requirements, with standard business hours and flexibility to support global stakeholders and critical program or regulatory needs. The annual salary range is $170,000–$282,500 for the primary location specified; the applicable range may differ for other work locations.

Requirements

Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline.
10 or more years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance.
Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles, including security-by-design, resilient controls, and adaptable technology standards.
Ability to translate complex technical and emerging risks into clear policies, standards, controls, investment priorities, and executive decisions.
Strong governance, technology risk, control design, exception management, and assurance capabilities within a large, regulated organization.
Proven leadership of complex, cross-functional cybersecurity or technology transformation programs with measurable outcomes and clear accountability.
Executive communication and influencing skills across Security, Engineering, Infrastructure, Cloud, Application Development, Risk, Legal, Procurement, Audit, and business teams.
Data-driven, risk-based decision-making ability, with attention to detail, strategic judgment, and a focus on sustainable risk reduction.
Commitment to simplification, standardization, collaboration, and scalable governance.
Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences in a large, highly regulated organization.
Ability to coordinate across global teams and time zones, support regulatory and audit engagements as needed, and manage sensitive information in accordance with company requirements.

Nice To Haves

Advanced degree preferred.
CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications preferred.
Knowledge of security and data protection discovery and inventory capabilities; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and reporting or dashboard technologies.
Travel may be required based on business needs.

Responsibilities

Establish and maintain the enterprise governance framework, policies, standards, decision rights, and accountability model for AI security, data protection, and emerging technology risk.
Govern discovery, inventory, classification, and risk assessment of AI models, data assets, security controls, platforms, applications, integrations, and technology dependencies.
Define risk-based prioritization criteria using data sensitivity, retention period, business criticality, external exposure, and migration complexity, including long-term data exposure and emerging technology risk.
Design minimum control requirements, testing procedures, evidence standards, exception processes, compensating controls, and remediation expectations across applications, infrastructure, cloud, networks, identity, and data platforms.
Establish and oversee the enterprise roadmap for transitioning vulnerable security and data protection implementations to approved secure technologies and control solutions, including delivery milestones, control gates, dependencies, and risk escalation.
Partner with Security Architecture and Engineering to embed AI security, data protection, security-by-design, and adaptable control requirements into solution design, architecture reviews, engineering standards, and reusable implementation patterns.
Define AI security and data protection requirements and due-diligence criteria for third-party products, cloud services, strategic vendors, contracts, and technology evaluations.
Serve as the subject-matter authority for AI security and data protection governance in engagements with senior leadership, Risk, Compliance, Internal Audit, external auditors, clients, and regulators.
Establish dashboards, key risk indicators, and performance measures for inventory coverage, AI and data risk exposure, control compliance, exceptions, migration progress, remediation, and residual risk.
Lead and develop a team responsible for governance, control oversight, risk assessment, program coordination, and cross-functional execution.
Coordinate across global teams and time zones, support regulatory and audit engagements as needed, and manage sensitive information in accordance with company requirements.

Benefits

Retirement savings plan (401K) with company match.
Insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages.
Paid time off, including vacation, sick leave, short-term disability, and family care responsibilities.
Access to an Employee Assistance Program.
Incentive compensation, including eligibility for annual performance-based awards, with certain sales roles subject to sales incentive plans.
Eligibility for certain tax-advantaged savings plans.
Inclusive development opportunities.
Flexible work-life support.
Paid volunteer days.
Employee networks.