Director, Information Protection

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

McKesson is seeking a strategic and results-oriented Director, Information Protection to lead enterprise-wide information protection initiatives that safeguard critical business and healthcare data.

This leader will define and execute McKesson's data protection strategy, ensuring sensitive information remains secure across cloud, endpoint, email, and collaboration environments while supporting business productivity and regulatory compliance.

The Director will partner across Cybersecurity, Privacy, Legal, Compliance, IT, and business teams to mature data protection capabilities, strengthen governance, and reduce enterprise risk.

This role requires a proven leader who can translate complex compliance requirements into scalable technical controls and drive measurable security outcomes.

Based on leadership expectations defined for the Director (M4) level.

• Develop and execute enterprise-wide data protection and DLP strategies aligned with business objectives and security priorities.
• Design, implement, and scale DLP programs across cloud, endpoint, email, and collaboration platforms to reduce data exposure risk while maintaining a positive user experience.
• Establish and oversee data classification, retention, encryption, and information governance programs spanning the full data lifecycle.
• Translate regulatory requirements, including HIPAA and protection of PHI/PII, into sustainable security controls, policies, and governance frameworks.
• Lead cross-functional initiatives with Cybersecurity, Privacy, Legal, Compliance, IT, and business stakeholders to drive adoption and operational maturity.
• Define governance standards, performance metrics, risk indicators, and compliance reporting for data protection programs.
• Drive continuous improvement through analytics, automation, process optimization, and emerging security technologies.
• Lead organizational planning, budget management, vendor relationships, talent development, and succession planning for multiple teams.

• 12+ years of professional experience, including 4+ years of people leadership experience leading enterprise-scale cybersecurity, data protection, information security, or governance programs.
• Proven experience designing and scaling DLP programs across cloud, endpoint, email, and collaboration environments.
• Hands-on expertise with data classification, retention, encryption, and information protection strategies.
• Experience implementing controls to protect regulated data, including PHI, PII, and other sensitive information.
• Demonstrated ability to translate regulatory requirements (HIPAA, privacy, compliance, and risk management frameworks) into effective technical and operational controls.
• Experience leading complex, enterprise-wide programs involving multiple business and technology stakeholders.
• Strong executive communication, strategic planning, and organizational leadership skills.
• Bachelor's degree or equivalent professional experience.

• Experience with Microsoft Purview, Insider Risk Management, Information Protection, or comparable enterprise data security…