Manager, Data Protection & Information Security Efficacy

Job Summary

The Data Protection & Information Security Efficacy Manager reports to the Business Information Security Officer (BISO) and collaborates with business and IT colleagues to deliver critical capabilities in support of strategic information security goals. This includes the operational management of data protection solutions, the delivery and reporting of information security program metrics, the adversary simulation services, contributions to security awareness & training and other business-facing information security services as assigned.

The role requires excellent communication skills and the ability to support multiple efforts across information security disciplines.

Job Description

As a member of the Information Security team and under the supervision of BISO, the Data Protection & Information Security Efficacy Manager is responsible for execution and maintenance of information protection solutions in alignment with the IS strategy and roadmap. Responsibilities include configuring and managing information security capabilities and rules/policies; monitoring control effectiveness; and partnering with business and IT teams to drive timely remediation.

The role also supports the ongoing identification, classification, and protection of vital and restricted ("crown jewel") data. Additional responsibilities include developing, maintaining, and reporting key metrics that demonstrate the performance, value, and maturity of the information security program. The individual will also contribute to the information security awareness program by supporting continuous education activities, including recurring phishing simulations. This role requires the ability to manage multiple priorities simultaneously, while operating independently with limited supervision.

Data Protection

• Configure, operate, and maintain DSPM and data protection technology platform, including classifiers, policies, correlation logic, and enforcement controls-to ensure consistent alignment with the enterprise information protection strategy.
• Partner with business and IT teams to identify vital and sensitive company data and implement the appropriate protection controls.
• Monitor and respond to alerts or reports of potential information or data exposure, coordinating with SOC and IT teams as needed to ensure timely analysis and response.
• Perform root cause analysis for identified threats or exposure events and drive corrective actions to prevent recurrence.
• Maintain, refine, and enhance information protection rulesets in collaboration with information security, business stakeholders, and IT teams, supporting the identification, remediation, or mitigation of data protection gaps.

Information Security Program Metrics

• Responsible for collection, analysis, and reporting of key performance indicators (KPIs) and key risk indicators (KRIs) across all information security program domains to measure control effectiveness and overall program maturity.
• Develop and maintain near-real-time dashboards that provide transparency into program performance, risk trends, and operational metrics for stakeholders and leadership.
• Conduct periodic benchmarking of the information security program by coordinating with BISO, Information Security, IT, and other stakeholders to evaluate progress against internal targets and industry standards.

Adversary Simulation & Penetration Testing

• Partner with IS and IT teams to execute the organization's annual strategy and roadmap for adversary simulations and internal and external penetration testing across network, web applications, and critical systems.
• Support with overseeing third party selection, planning and execution of internal and external testing activities, ensuring alignment with approved methodologies and rules of engagement.
• Evaluate and synthesize test results to identify systemic risks, control weaknesses, and emerging patterns.
• Partner with security, IT, and business stakeholders to ensure remediation actions are prioritized, tracked, and validated.
• Prepare input and summaries for executive-level reporting on testing outcomes, risk posture, and improvements to strengthen overall security resilience.

Security…