Cyber Policy Enforcement Lead, VP

The Cyber Policy Enforcement Lead, VP is responsible for leading the enterprise capability that ensures Cyber Policies and Standards are consistently enforced across the organization.

This role drives accountability for cyber compliance through structured enforcement mechanisms, timely risk-based escalation, and managing the consequence management processes. The role serves as the central coordination point for cyber policy enforcement activities, enabling policy and standard requirements are embedded within business processes, ownership is clearly defined, risks are escalated appropriately, and corrective actions are effectively monitored through resolution.

The VP partners closely with cybersecurity SMEs, business stakeholders, and senior leadership to define enforceable requirements, monitor performance metrics, identify consequence considerations, and deliver clear reporting that enables informed management decision-making.

• Lead the enterprise Cyber Policy Enforcement and Consequence Management capability, enabling consistent application of Cyber Policy and Standard requirements across business units and functions.
• Develop, implement, and continuously enhance policy enforcement, escalation, and consequence management frameworks, processes, and governance mechanisms.
• Partner with SMEs from Global Cybersecurity, Technology, Risk, Compliance, and Business stakeholders to establish enforcement priorities, remediation expectations, and consequence management activities.
• Drive integration of policy enforcement requirements into business processes, governance forums, and risk management practices.
• Facilitate structured engagement forums to review compliance performance, residual risks, remediation progress, and enforcement actions as applicable.
• Prepare and present compliance, enforcement, and risk insights to senior leadership, risk committees, and governance forums.
• Monitor compliance performance and risk trends, identify systemic issues and root causes, and drive sustainable remediation and continuous improvement.
• Define and track key performance indicators (KPIs) and leverage automation opportunities to enhance monitoring, reporting, and workflow efficiency.
• Conduct periodic reviews and updates of enforceable requirements, monitoring expectations, consequence considerations to ensure continued relevance and effectiveness.

• Bachelor's degree in Cybersecurity, Information Technology, Risk Management, Business Administration, or a related field required.
• Master's degree preferred.
• Relevant industry certifications strongly preferred, such as:
  • CISSP (Certified Information Systems Security Professional)
  • CISM (Certified Information Security Manager)
  • CRISC (Certified in Risk and Information Systems Control)
  • CGEIT (Certified in the Governance of Enterprise IT)
  • CISA (Certified Information Systems Auditor)

• 10+ years of progressive experience in cybersecurity, technology risk, operational risk, governance, risk and compliance (GRC), or related disciplines.
• Demonstrated experience designing and implementing policy enforcement, issue management, escalation, and/or consequence management frameworks within a large, complex organization.
• Strong understanding of cybersecurity governance, risk management, control frameworks, and regulatory expectations within highly regulated industries.
• Experience leading cross-functional initiatives involving cybersecurity SMEs, technology teams, and business partners to achieve risk reduction and compliance objectives.
• Experience managing enterprise-scale stakeholder relationships across business, technology, risk, audit, and executive leadership functions.
• Proven track record of driving accountability and influencing senior stakeholders to address non-compliance, remediate risks, and improve control effectiveness.
• Experience developing and presenting executive-level reporting, risk assessments, metrics, and recommendations to senior management, risk committees, and governance forums.

• Deep understanding of cybersecurity governance, policy management, standards management, control monitoring, and risk oversight practices.
• Strong knowledge of industry frameworks and regulations, including NIST, ISO 27001, COBIT, FFIEC, SEC, and other relevant regulatory requirements.
• Strong analytical and problem-solving skills with the ability to assess complex risks and recommend practical, risk-based solutions.
• Ability to influence without direct authority…