Executive Director, Data Protection & Privacy

CVS Health•Scottsdale, AZ

5d•$175,100 - $334,750

About The Position

CVS Health is seeking a highly experienced, strategic executive to own and mature its enterprise data protection program. The role is accountable for the strategy, design, and operational execution of data loss prevention, data discovery and classification, data privacy engineering, and related controls protecting sensitive, regulated, and member data across a large, complex, highly regulated healthcare environment. The successful candidate will combine technical expertise in data security architecture with the executive presence to engage senior leadership, Legal, Compliance, and business stakeholders on data risk. The position is responsible for reducing organizational data exposure risk, supporting regulatory alignment, and building a scalable, defensible data protection program. It leads enterprise DLP, discovery, classification, and privacy engineering efforts; collaborates on regulatory and incident response; defines program metrics and executive reporting; and builds and develops a high-performing team. The role also advises leadership on emerging data risks, including those involving generative AI and new data platforms.

Requirements

At least 15 years of experience in data protection, data privacy, or information security, including at least 5 years in a senior leadership or executive-level role.
Proven experience designing, building, and operationalizing enterprise DLP programs across endpoint, network, email, and cloud/SaaS environments.
Demonstrated experience leading enterprise data discovery initiatives and identifying and inventorying sensitive data across structured and unstructured stores.
Demonstrated experience establishing data classification standards and taxonomy across systems and platforms.
Hands-on experience with data privacy engineering techniques, including encryption, tokenization, data masking, and anonymization.
Strong working knowledge of HIPAA, GDPR, CCPA/CPRA, and applicable state privacy laws.
Demonstrated experience leading cross-functional teams, managing enterprise data protection programs, and driving strategic initiatives at the executive level.
Experience advising boards and executive stakeholders on data protection and privacy risk.
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Law, or a related field.
In-depth technical expertise in data protection, DLP, data classification, and privacy engineering concepts and technologies.
Strong executive communication skills and ability to translate complex data risk concepts for technical and non-technical stakeholders.
Ability to influence without direct authority and build consensus among stakeholders with competing priorities.
Excellent problem-solving skills, with a focus on scalable, defensible, and business-enabling data protection solutions.
Strong leadership capabilities, including experience building, mentoring, and scaling technical teams.
Sound judgment in balancing data protection rigor with business enablement and user experience.

Nice To Haves

Experience within a large, highly regulated healthcare, insurance, or financial services organization.
Experience integrating data protection and privacy controls into cloud-native and AI/ML environments, including AWS, Azure, or GCP.
Experience with data security posture management (DSPM) and modern data governance platforms.
Experience building or maturing an insider risk management program.
Certified Information Privacy Professional (CIPP) certification.
Certified Information Privacy Manager (CIPM) certification.
Certified Data Privacy Solutions Engineer (CDPSE) certification.
Master's degree or JD.
Ongoing education in data privacy, data security, or related domains.

Responsibilities

Define and drive the enterprise Data Protection and Privacy strategy, roadmap, and multi-year investment plan, aligned with business, legal, and regulatory priorities.
Own the design, deployment, and continuous tuning of enterprise DLP controls across endpoint, network, email, cloud, and SaaS channels.
Lead enterprise-wide data discovery to identify, inventory, and map sensitive and regulated data across structured, unstructured, and cloud data stores.
Establish and operationalize data classification standards, taxonomy, and labeling schemes across systems, applications, and third-party platforms.
Partner with engineering and application teams to embed privacy-by-design and privacy-enhancing technologies into data pipelines, platforms, and AI/ML workflows.
Ensure the data protection program aligns with HIPAA, GDPR, CCPA/CPRA, and other applicable state and federal privacy regulations; partner with Legal and Compliance on data subject requests, breach notification obligations, and audits.
Partner with Detection Engineering and Incident Response to develop and refine detection use cases for data exfiltration, insider risk, and unauthorized data movement; lead data-related incident response and forensics as needed.
Establish program metrics, KPIs, and executive reporting to measure maturity and effectiveness, and present regularly to senior leadership and risk committees.
Build, mentor, and scale a high-performing team of data protection and privacy engineers and analysts, fostering technical excellence and business partnership.
Advise executive leadership, Legal, Internal Audit, and business unit stakeholders on emerging data risks, including risks introduced by generative AI and new data platforms.
Stay current on data protection technologies, privacy regulations, and industry threats, and continuously evolve the program to address new data types, platforms, and business models.