Sr. Director of Security & Information Governance

Jackson Lewis•New York City, NY

About The Position

The Senior Director, Security & Information Governance provides strategic leadership for Jackson Lewis P.C.’s enterprise technology security, information governance, records management, and technology risk programs. Reporting to the Chief Information Officer, this highly visible, collaborative role partners with executive leadership, attorneys, and business services teams to protect Firm and client information, strengthen cyber resilience, and oversee security technologies that support secure adoption of emerging technologies, including artificial intelligence. The Senior Director serves as a trusted advisor to Firm leadership, aligning security initiatives, security architecture, and capabilities with business strategy and client service. The position leads enterprise security and records programs, including security governance, identity and access management, data protection, cloud governance, incident response governance, vulnerability management, information lifecycle management, records retention, and legal holds. It also guides security controls and policies, oversees threat monitoring and incident readiness, develops security awareness and training, and supports client security reviews. The role establishes and advances AI governance and collaborates with IT leadership, Risk Management, General Counsel, Records Management, Privacy, and Practice Groups to integrate technology governance into Firm operations and strategic initiatives.

Requirements

Bachelor's degree in Information Security, Information Technology, Computer Science, Business, or a related discipline.
10+ years of progressive leadership in information security, information governance, technology risk, or enterprise security.
Demonstrated experience leading enterprise security governance, client security compliance, and cross-functional initiatives.
Strong understanding of AI governance, information lifecycle management, privacy, and regulatory compliance.

Nice To Haves

Experience in an Am Law 200, professional services, or highly regulated environment.
Professional certifications such as CISSP, CISM, CRISC, IGP, CIPM, or CPP.

Responsibilities

Lead the Firm's technology risk, cybersecurity governance, and records programs, including identity and access management, data protection, cloud governance, incident response governance, vulnerability management, and oversight of enterprise technology controls.
Oversee security technologies and controls relevant to AI-enabled platforms, data protection, monitoring, identity, endpoint, email, network, and cloud environments.
Guide policy governance, network segmentation, secure access controls, and change management processes to reduce risk and support secure business operations.
Oversee threat hunting, security monitoring, detection engineering, vulnerability prioritization, and incident readiness activities in partnership with business services departments and practice leadership.
Develop and maintain enterprise security policies, standards, and procedures aligned with NIST, ISO 27001, client outside counsel guidelines, and legal industry best practices.
Direct the Firm's Information Governance and Records Management program, including records retention, legal holds, and information lifecycle management.
Lead AI governance initiatives by establishing policies, risk assessments, technical controls, monitoring requirements, and security review processes for responsible, secure, and client-compliant use of generative AI and emerging technologies.
Oversee enterprise security awareness and training, including phishing simulations, role-based education, executive briefings, new hire onboarding, and ongoing awareness campaigns.
Partner with Client Relationship teams on security questionnaires, audits, due diligence reviews, and client meetings regarding the Firm's security posture.
Develop key indicator reporting, risk indicators, and program metrics for the CIO and Firm leadership, and drive continuous improvement across security and governance programs.
Collaborate with IT leadership, Risk Management, General Counsel, Records Management, Privacy, and Practice Groups to integrate technology governance into Firm operations and strategic initiatives.
Drive technology and practice enhancements that increase the Firm's general security posture.
Perform other duties as assigned.