Information Governance Program Manager

Ropes & Gray•Boston, MA

1d•Hybrid

About The Position

The Information Governance Program Manager owns, directs, and matures Ropes & Gray’s Information Governance Risk & Compliance program and is accountable for program outcomes, target achievement, and continuous improvement. The role leads cross-functional initiatives across compliance, policy, information lifecycle management, technology governance, and organizational change, including work that depends on stakeholders outside the role’s direct reporting authority. It also owns the Information Governance requirements and oversight framework for generative AI, SaaS, cloud, and emerging technologies, with accountability for understanding where firm and client information resides, how it moves across systems, who can access it, and how it is retained, preserved, and defensibly disposed. The position directs Information Governance programs and compliance activities; oversees governance requirements for technologies and vendors; maintains policies, standards, roadmaps, metrics, and auditable program records; and leads stakeholder engagement, change management, and continuous improvement. It manages the program budget and service providers, exercises delegated approval authority, and reports program performance and corrective actions to leadership. The role requires a bachelor’s degree and 7–10 years of law firm or professional services experience. A relevant degree and experience in Information Governance, compliance, risk management, records management, privacy, or related disciplines are preferred. The position requires hybrid on-site presence as an essential function. The anticipated salary range varies by location: $134,700–$205,450 in Boston, Chicago, Los Angeles, and Washington, D.C.; $145,800–$222,350 in New York; and $151,900–$231,650 in San Francisco and Silicon Valley. The role is eligible for a discretionary performance-based bonus.

Requirements

Bachelor’s degree required.
7–10 years of law firm or professional services experience.
Demonstrated experience leading complex cross-functional programs, projects, or organizational change initiatives, with accountability for outcomes even when contributors do not report directly to the program lead.
Demonstrated ability to define measurable program targets, monitor performance, and take corrective action to achieve expected outcomes.
Experience owning or leading compliance programs involving privacy, records management, Information Governance, regulatory requirements, client obligations, audits, or remediation.
Familiarity with application inventories, data mapping, information lifecycle management, access governance, retention, legal hold, and defensible disposition.
Strong program and project management, business analysis, problem-solving, quality assurance, and process improvement skills.
Ability to manage competing priorities, make decisions within delegated authority, and maintain visibility into objectives, risks, dependencies, performance targets, and decisions.
Strong written and verbal communication skills and ability to work effectively with attorneys, business stakeholders, technical teams, vendors, and firm leadership.
Demonstrated ability to establish accountability, influence outcomes, resolve cross-functional issues, and build consensus without direct reporting authority.
Advanced proficiency with Microsoft Office applications, including Excel, Word, Outlook, PowerPoint, and Teams.
Hybrid on-site presence is required as an essential function of the role, with consistent and predictable on-site presence.

Nice To Haves

A degree in a relevant field is strongly preferred.
Experience managing program budgets, forecasts, vendor relationships, contracts, service levels, or external service delivery.
Experience applying Information Governance principles to cloud services, SaaS applications, collaboration platforms, generative AI, or other emerging technologies.
Working knowledge of relevant security, privacy, AI governance, and Information Governance frameworks, standards, and regulations, such as GDPR, HIPAA, ISO 27001, NIST AI RMF, or LFIGS.
Experience with Microsoft 365, including Purview and related governance capabilities.
Experience with iManage Work and associated Information Governance tools.
Information Governance Professional (IGP), Certified Records Manager (CRM), Project Management Professional (PMP), or similar certification.

Responsibilities

Direct Information Governance programs, projects, and strategic initiatives in alignment with firm priorities, client requirements, Outside Counsel Guidelines, and regulatory obligations; set priorities, assign cross-functional accountabilities, and drive execution.
Maintain governance roadmaps, project plans, milestones, dependencies, status reports, performance metrics, and program documentation; define targets and remain accountable for achieving them.
Manage program health and maturity; identify risks, control gaps, resource constraints, competing priorities, and remediation opportunities; direct corrective action or escalate matters requiring executive attention.
Direct governance-related compliance activities, including audits, remediation, client requests, regulatory inquiries, and vendor guidance requests; own findings and action items through closure and approve remediation plans within delegated authority.
Lead change management for Information Governance initiatives, including stakeholder engagement, communications, policy implementation, technology adoption, training, and process improvement.
Lead Information Governance activities for generative AI, SaaS, cloud, and emerging technologies, covering prompts, outputs, source materials, workspaces, repositories, logs, and other information created, processed, or stored in those platforms.
Own Information Governance components of application inventories and data mapping, ensuring visibility into information locations, movement between systems, ownership, access, retention, and disposition requirements.
Direct cross-functional assessments with Information Security, Privacy, Legal Technology, IT, Procurement, application owners, the Office of the General Counsel, and other stakeholders to establish lifecycle, access, retention, legal hold, data minimization, and defensible disposition requirements.
Develop and operationalize governance standards for AI and SaaS platforms, including data ownership, access review, retention, deletion, and periodic review of obsolete, duplicative, or unnecessary information.
Manage technology initiatives involving information lifecycle management, data classification, retention and disposition, approved repositories, collaboration platforms, generative AI, and emerging technologies.
Direct Information Governance reviews of software, cloud services, vendors, and technology initiatives; define and approve governance requirements, retention standards, controls, data-location requirements, and implementation conditions within delegated authority.
Manage the Information Governance component of third-party risk activities with Information Security; approve applicable governance requirements and risk-treatment conditions within delegated authority and document decisions and approved risk exceptions.
Own Information Governance policies, procedures, workflows, communications, and program records; approve operational standards within delegated authority and direct improvements to program effectiveness and maturity.
Promote Information Governance awareness and accountability through collaboration, education, communication, and continuous improvement.
Exercise delegated approval authority for governance requirements, retention standards, control requirements, and risk exceptions; maintain an auditable approval record and escalate decisions outside delegated authority.
Manage the Information Governance program budget, forecasts, purchase requests, and spend against plan; identify resource trade-offs and ensure effective use of approved funds.
Manage Information Governance vendors and service providers, including selection support, contracting requirements, performance, service levels, renewals, issue resolution, and delivery against agreed outcomes.
Establish program objectives, key performance indicators, and maturity targets; report results to leadership and own corrective actions when performance is off target.