Director & Senior Cybersecurity Counsel

Under the direction of the Vice President & Chief Information Security Officer, The Director & Senior Cybersecurity Counsel serves as the principal technical-legal executive responsible for mitigating enterprise information risk through advanced transactional engineering, technical security oversight, and data defense operations. This role leverages a dual mastery of corporate law and cybersecurity frameworks to architect, draft, and negotiate critical cybersecurity and artificial intelligence (AI) provisions within vendor and technology agreements, closing unhedged data liability loops in the third-party ecosystem. This position leads the Governance, Risk, and Compliance (GRC) Assessment team and Data Protection team, overhauls the enterprise E-Discovery and data retention tracking framework, and directs high-visibility security culture initiatives. Acting as a key advisor to executive leadership, this role translates complex technical vulnerabilities into financial risk quantification models, represents the cybersecurity division in Enterprise Risk Management (ERM) discussions, and provides definitive risk-based legal guidance surrounding emerging AI implementations.

Essential Functions\:

• Lead and oversee the enterprise Governance, Risk, and Compliance (GRC) program, including vendor risk management, compliance and audits, governance and training, data protection, and enterprise risk management.
• Direct cybersecurity and AI risk mitigation efforts through the development, review, and negotiation of security provisions, data protection agreements, vendor contracts, SaaS procurements, and Master Services Agreements (MSAs).
• Establish and maintain enterprise data protection standards, including data classification, retention, data loss prevention (DLP), e-discovery, data preservation, and Data Use Agreement (DUA) governance.
• Manage third-party cybersecurity risk by overseeing vendor security assessments, contract standards, due diligence activities, and alignment with organizational security requirements.
• Oversee regulatory and security compliance programs, including HIPAA, HITECH, PCI DSS, and other applicable cybersecurity frameworks, standards, and regulatory requirements.
• Lead cybersecurity governance initiatives, including policy development, risk register management, quantitative risk assessment methodologies, and continuous improvement of GRC processes.
• Direct enterprise cybersecurity assessment and audit activities, utilizing frameworks such as NIST CSF, supporting internal and external audits, and ensuring effective remediation of identified risks.
• Develop and champion cybersecurity awareness and education programs, driving organizational compliance, risk reduction, and a culture of security through targeted training and engagement strategies.
• Provide strategic cybersecurity guidance to senior leadership, delivering risk insights, compliance reporting, remediation recommendations, and balanced solutions that support business objectives while minimizing risk.
• Lead and develop high-performing teams, including budget oversight, resource planning, career development, performance management, and fostering alignment with organizational values and high-reliability principles.