This role pays less than
72%
of similar roles. Most pay
$161,250–$226,350
— the shaded band above.
At the midpoint, this role pays about
$161k
versus about
$194k
for comparable roles.
Based on 240 similar postings.
Employer
About State Street
State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody
State Street currently has
185 open roles
on FindRole.
Listed pay typically runs
$120,000–$202,500
across 181 roles with salary data.
The AI Security and Data Protection Governance and Controls VP joins the Global Cybersecurity team to establish and oversee the enterprise governance framework for secure, resilient AI and data protection capabilities. Reporting to the Managing Director, Data Protection, you will translate strategy into policies, standards, controls, and measurable remediation programs while managing a dedicated team. You will be responsible for governing the discovery, inventory, and risk assessment of AI models and data assets across infrastructure, cloud, and third-party services. Key responsibilities include designing minimum control requirements, defining due-diligence criteria for vendors, and developing performance dashboards. The role requires expertise in security architecture, PKI, certificate management, and GRC platforms. You will address emerging technology risks within a large, regulated organization by embedding security-by-design principles into the lifecycle of enterprise applications and data platforms.
Establish the enterprise governance framework, policies, and accountability models for AI security and data protection.
Oversee the discovery, inventory, classification, and risk assessment of AI models and data assets.
Define risk-based prioritization criteria for data sensitivity, business criticality, and emerging technology risks.
Design minimum control requirements, testing procedures, and remediation plans across all infrastructure and platforms.
Manage the roadmap for transitioning vulnerable systems to approved secure technologies and control solutions.
Embed security-by-design and AI protection requirements into architecture reviews and engineering standards.
Establish due-diligence criteria for third-party products, cloud services, and strategic vendor contracts.
Develop performance dashboards and key risk indicators to track compliance and remediation progress.
What we're looking for
Bachelor’s degree in Information Security, Computer Science, Engineering, Mathematics, AI Security and Data Protection, or a related discipline.
Advanced degree (preferred).
10+ years of progressive experience in cybersecurity, AI security, data protection, security architecture, technology risk, or control governance.
CISSP, CISM, CRISC, CCSP, cloud security, or comparable industry certifications (preferred).
Experience developing enterprise security policies, standards, and controls; leading cross-functional transformation; engaging vendors; and communicating with executive, audit, regulatory, and non-technical audiences.
Knowledge of PKI, certificate/key management, cloud and enterprise security architectures, and GRC platforms.
Ability to coordinate across global teams and time zones while managing sensitive information in a large, regulated organization.
Deep understanding of AI security, data protection, security architecture, governance, risk, and control principles.
AI
Machine Learning
Generative AI
large language model s
Security Architecture
Cloud Security
DevSecOps
CI/CD
Threat Modeling
Data Pipelines
Identity and Access Management
NIST
ISO
FFIEC
Data Protection
Security Automation
AI
Machine Learning
Generative AI
Security Architecture
Cloud Security
DevSecOps
CI/CD
Threat Modeling
Data Pipelines
Identity and Access Management
NIST
ISO
FFIEC
Data Protection
Security Automation
Generative AI
Large Language Models (LLMs)
Microsoft Azure
FinOps
Enterprise Architecture
Jira
Confluence
ServiceNow
Cost Management
Reporting
Dashboarding
Documentation