Principal – Cyber Security

General information

# 21301

Remote? No

Ally Financial only succeeds when its people do - and that’s more than some cliché people put on job postings. We live this stuff! We see our people as, well, people - with interests, families, friends, dreams, and causes that are all important to them. Our focus is on the health and safety of our teammates as well as work-life balance and diversity and inclusion.

From generous benefits to a variety of employee resource groups, we strive to build paths that encourage employees to stretch themselves professionally. We want to help you grow, develop, and learn new things. You’re constantly evolving, so shouldn’t your opportunities be, too?

At Ally, you get a startup feel, but experience the benefits of a company that has worked out the kinks and is fulfilling its purpose. We are always evolving and see that as a good thing. From owning our work to seeing its impact in the real world, our team is relentless in finding new ways technology can help make experiences better and help people.

We are problem solvers, we value diverse thinking, we support one another, and we challenge ourselves to think bigger in the journey to deliver customer-obsessed tech solutions. To read more about what our tech team does, be sure to visit our tech blog hThe Principal of Cyber Security position at Ally is a member of the Information Protection and Risk Management team and works closely with other members of the IPRM program to develop and implement a comprehensive approach to the management of security risks  Principal of Cyber Security role requires an individual with a strong technical background as well as an ability to work with the IT organization and business management to align priorities and plans with key business objectives.

Responsible for providing technical guidance to staff as they work to accomplish company objectives. This is a mid-level to senior-level highly technical role driving strategic programs in data security, privacy, governance, and cyber resiliency, and serve as a key advisor on data protection and privacy initiatives.

Lead Data Security & Privacy Initiatives:
Work with the Director Cyber Security Lead to ensure the security program addresses identified risks and business requirements. Manage the process of gathering, analyzing and assessing the current and future threat landscape, as well as providing the Director Cyber Security Lead with a realistic overview of risks and threats in the enterprise environment. Oversee enterprise-wide data discovery and classification efforts, ensuring accurate identification and categorization of sensitive information across structured and unstructured data sources.

Champion data obfuscation strategies, including masking, tokenization, de-identification, and redaction, to safeguard confidential data in production and non-production environments. Develop and maintain data privacy controls, aligning with regulatory requirements (PCI, SOX, GLBA, NYDFS, Sarbanes-Oxley, etc.) and internal policies. Collaborate with Risk Assessment and Data Governance teams to remediate risk findings and implement mitigation strategies.

Regulatory Process Management:
Ensure the organization's data security posture meets audit and regulatory standards. Prepare and validate checklists and documentation for compliance reviews and regulatory exams. Stay current on evolving privacy laws and regulations, translating requirements into actionable security controls.

Technical Leadership:
Design and implement data security solutions for on-premises and cloud environments (AWS, Azure). Manage deployment and sustainment of data security technologies (e.g., Delphix, IBM Optim, BigID, Informatica, Gen Rocket). Guide the team in developing and maintaining automated tools for data profiling, masking, and reporting. Measure KPI & KRIs against defined objectives and proactively predict potential critical risks.

Team Development & Stakeholder Engagement:
Mentor and develop team members, fostering a culture of continuous improvement and innovation. Build strong relationships with business, IT, and compliance…