Data Security Director

Job Overview

Lead the vision, design, and implementation of data security controls  role leads the data security team, develops strategies, and conducts readiness assessments for enterprise data security standards, focusing on encryption programs, policies, and data protection services.

• Develops, coordinates, and is accountable for the Secure Data Strategy, embedding security into CNA’s overall data vision.
• Builds, leads, and has full management responsibility for the performance and development of a team of experienced data security professionals.
• Oversees Secure Data Integration, incorporating data discovery, classification, and remediation processes aligned with business processes protecting data from various sources.
• Directs the implementation of technical capabilities such as rights management to enforce the movement or transmission of data.
• Implements technical capabilities to identify, classify, and secure structured and unstructured data assets in the cloud.
• Collects and analyzes business and event data to drive security value and enable the utilization of data as a business asset.
• Documents and advises on areas of security improvement that balance risk with business operations without diminishing efficiencies or innovation.
• Collaborates with Legal to identify current and potential legal and regulatory issues affecting information security and assess their impact on CNA’s security and technology teams.
• May perform additional duties as assigned.

• Expert level knowledge of data security concepts.
• Proven ability to effectively lead, coach, and develop a data security group.
• Strong knowledge of the insurance industry, its products, and services.
• Strong knowledge of data security technical solutions (e.g., data loss prevention, classification inventorying tools, data discovery).
• Expert knowledge of traditional and modern cloud data solutions.
• Ability to assess risks in line with information security objectives and risk tolerance of the institution.
• Proven conceptual, analytical, and evaluation skills.
• Excellent interpersonal, verbal, presentation, and written communication skills with the ability to interact with internal and external business partners.
• Ability to work well independently, under pressure, and to meet tight deadlines.
• Excellent project management skills with ability to organize, prioritize, and plan effectively to meet project goals.
• Expert knowledge of privacy/data standards and regulations local, domestic, and global (State Level Data Protection, ISO, GAPP, NIST 800‑53, HIPAA, Hitrust, Privacy by Design, GDPR, EU Data Protection Directives, CCPA, APEC Privacy Framework).

Bachelor’s Degree required;
Master’s preferred in Computer Science or a related discipline.

Typical minimum experience includes:

• 10+ years of IT security experience, with recent focus on cloud security.
• 5+ years of security architecture experience designing or implementing data security solutions.
• 5+ years of experience designing or building data security programs (classification, governance, rights management, data loss prevention).
• 3+ years of experience in data protection solutions within cloud environments (AWS, Azure, GCP).
• 5+ years of hands‑on experience with data security vendors and product capabilities.

• Salary range (for certain jurisdictions): $97,000 to $189,000 annually.
• Comprehensive benefits package for employees and family members, supporting physical, financial, emotional, and social wellbeing.

CNA is committed to providing reasonable accommodations to qualified individuals with disabilities in the recruitment process. Contact  for accommodations.