AI Security and Data Protection Governance and Control, VP

Who We Are Looking For

We are looking for a team leader to lead AI Security and Data Protection Governance and Controls, reporting to the Global Head of Data Protection. You will set the enterprise strategy and accountability model for secure, resilient, and responsible AI and data protection capabilities, translating emerging risk into business-aligned policies, standards, controls, investment priorities, and measurable outcomes. You will lead a multidisciplinary team and partner with senior leaders across Security, Technology, Risk, Compliance, Legal, Procurement, Internal Audit, and the business to embed security-by-design and scalable governance across enterprise platforms, applications, data, and third-party services.

Why This Role is Important To Us

The team is part of Global Cybersecurity, a function vital to protecting the confidentiality, integrity, availability, and resilience of the firm's information and technology environment. This leadership role is accountable for anticipating AI, data, and emerging technology risks; establishing a consistent enterprise control posture; directing remediation and transformation priorities; and representing the program with executive leadership, clients, auditors, and regulators. The role will enable the organization to adopt AI and data-driven capabilities securely while maintaining regulatory readiness and sustainable risk reduction.

What You Will Be Responsible For

In this role, you will:

Set the enterprise vision, strategy, governance model, and multi-year roadmap for AI security, data protection, and emerging technology risk.

Lead, develop, and retain a multidisciplinary team responsible for governance, control oversight, risk assessment, assurance, program execution, and stakeholder engagement.

Establish enterprise policies, standards, control objectives, decision rights, risk ownership, and accountability across AI models, data assets, applications, infrastructure, cloud, identity, networks, and third-party services.

Direct the discovery, inventory, classification, and risk assessment of AI models, sensitive data, security controls, platforms, integrations, and critical technology dependencies.

Approve risk-based prioritization criteria and investment decisions using data sensitivity, business criticality, external exposure, retention, control maturity, regulatory impact, and remediation complexity.

Sponsor minimum control requirements, testing and evidence standards, exception governance, compensating controls, risk acceptance, and remediation expectations across the enterprise.

Oversee the transition of vulnerable or noncompliant implementations to approved secure technologies and control solutions, including milestones, funding, dependencies, control gates, and executive escalation.

Partner with Security Architecture and Engineering leaders to embed AI security, data protection, security-by-design, and adaptable control requirements into architectures, engineering standards, and reusable implementation patterns.

Establish third-party AI security and data protection requirements for products, cloud services, strategic vendors, due diligence, contracts, and ongoing oversight.

Serve as the senior subject-matter authority for AI security and data protection governance in engagements with executive leadership, Risk, Compliance, Legal, Internal Audit, external auditors, clients, and regulators.

Define management reporting, key risk indicators, performance measures, and executive dashboards covering inventory, exposure, control compliance, exceptions, remediation, roadmap delivery, and residual risk.

Own program operating rhythm, resource planning, budget priorities, and cross-functional governance to drive timely decisions and measurable risk reduction.

What We Value

These skills will help you succeed in this role:

Enterprise leadership experience spanning AI security, data protection, security architecture, cybersecurity governance, technology risk, and control transformation.

Ability to convert complex technical, regulatory, and emerging risks into clear enterprise strategy, policy, control requirements, funding priorities, and executive decisions.

Strong judgment in control design, assurance, exception management, risk acceptance, issue remediation, and regulatory engagement within a large, regulated organization.

Proven success leading senior teams and complex, cross-functional transformation programs with measurable outcomes, clear accountability, and sustained adoption.

Executive presence and influence across Security, Engineering, Infrastructure, Cloud, Application Development, Data, Risk, Legal, Procurement, Audit, and business leadership.

Data-driven, risk-based decision making with the ability to balance strategic direction, delivery urgency, regulatory obligations, and operational resilience.

Commitment to developing talent, simplifying governance, standardizing controls, and building scalable operating models.

Education & Preferred Qualifications

Degree required: Bachelor's degree in Information Security, Computer Science, Engineering, Mathematics, Data Science, or a related discipline; advanced degree preferred.

Years of experience: 13+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance, including significant leadership responsibility in a large, complex organization.

Leadership experience: Demonstrated experience leading managers and senior professionals, setting enterprise strategy, governing multi-year transformation, and influencing executive-level decisions.

Certifications required or preferred: CISSP, CISM, CRISC, CCSP, cloud security, privacy, AI governance, or comparable industry certifications preferred.

Knowledge of tools or technologies: AI model and data discovery; data classification and protection; PKI; certificate and key management; cloud and enterprise security architectures; asset, configuration, governance, risk, and compliance platforms; and executive reporting or dashboard technologies.

Additional language requirements: N/A.

Other qualifications: Experience establishing enterprise policies, standards, and controls; directing cross-functional transformation; governing third-party risk; managing executive and regulatory relationships; and communicating complex risk to technical and non-technical audiences.

Additional Requirements

Additional requirements include the ability to lead across global teams and time zones, support regulatory and audit engagements, manage sensitive information in accordance with company requirements, and provide executive coverage for critical program or risk matters. Travel may be required based on business needs.

Work Requirement

Hybrid Work Requirement: Hybrid, subject to company and location-specific requirements.

Shift Timings: Standard business hours with flexibility to support global stakeholders, executive engagements, and critical program, incident, audit, or regulatory needs.

Salary Range:

$120,000 - $217,500 Annual

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street’s comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

For a ful