Director Data Risk & Protection
Bristol Myers Squibb
August 13, 2026
Remote friendly (Princeton, NJ)
United States
IT
Key Responsibilities
- Define and lead BMS’s enterprise Data Risk and Protection strategy aligned to risk appetite, regulatory requirements, and cybersecurity strategy.
- Design and implement the Data Risk and Protection operating model and integrated engagement with Cybersecurity Fusion Center, Legal, HR, Compliance, Audit, and key Business Units.
- Establish, maintain, and continuously evolve the Data Risk & Protection program (policy governance, use-case development, monitoring, detection, response, remediation).
- Develop and execute a multi-year capability roadmap with priorities, milestones, measurable KPIs, and outcome-based risk reduction.
- Lead scaling and maturation of the Data Risk & Protection function and build a high-performing team.
- Provide program status reporting and risk posture updates to senior leadership/governance bodies.
Inside Risk & Threat Analysis
- Operationalize insider threat monitoring and behavioral analytics.
- Define insider threat personas, use cases, and detection scenarios (IP theft, clinical trial data exfiltration, fraud/sabotage, negligent data leakage, Generative AI misuse).
- Collaborate with technical teams to refine monitoring/analytics (UEBA, DLP, CASB, endpoint/identity telemetry, cloud and privileged access monitoring) to improve detection coverage and reduce false positives.
- Oversee insider risk case lifecycle from alert through closure and lessons learned.
- Lead risk-based incident response and root-cause analysis.
- Assess and mitigate data risks from Generative AI and emerging technologies.
Data Loss Prevention (DLP) & Information Protection
- Lead enterprise DLP strategy and operations across endpoints, email, cloud, collaboration platforms (e.g., Microsoft 365/Teams/SharePoint/Copilot, AWS, Google Cloud).
- Define/govern data classification policies and standards for sensitive and regulated data.
- Tune and manage DLP rules/policies/controls.
- Partner with IT Security Architecture/Engineering to embed controls into infrastructure and cloud workflows.
- Establish DLP effectiveness metrics/dashboards and report to senior leadership.
Policy, Governance, Assurance & Culture
- Develop and maintain data risk and protection policies/standards/guidelines (including GenAI usage).
- Establish escalation paths, decision rights, and documentation standards for incidents/insider risk cases.
- Lead/support assurance and audit activities (targeted reviews, thematic assessments, control effectiveness deep-dives).
- Design stakeholder awareness, education, and role-based training.
- Foster trust/accountability and represent BMS in relevant external/regulatory/peer forums.
Qualifications
- Bachelor’s degree required in Computer Science, Information Systems, Cybersecurity, Risk Management, Law, Business Administration, or related field; Master’s preferred.
- Certifications strongly preferred: CISSP, CISM, CISA, CRISC, CDPSE, CFE (or equivalent).
- 10+ years progressive experience in cybersecurity/data risk/insider risk/information protection/security operations; demonstrated leadership of complex enterprise programs (pharma/life sciences or highly regulated preferred).
- Hands-on experience owning DLP/insider threat/UEBA/security investigations.
- Technical fluency with SIEM, UEBA, DLP, EDR/XDR, CASB, IAM and PAM, and cloud security (Microsoft 365 Security, Azure, AWS).
- Familiarity with legal/privacy/employment/ethical considerations and regulations (GDPR/CCPA/HIPAA); must work closely with Legal/HR/Compliance.
- Ability to recruit/develop teams, define operating models/governance, and drive measurable outcomes.
- Experience leading complex cross-functional investigations.
- Strong analytics and communication/influencing skills.
- Ability to handle sensitive/confidential/legally privileged information.
Compensation and Benefits (as stated)
- Princeton, NJ: $188,790–$228,763 base; additional incentive cash/stock may be available (based on eligibility).
- Benefits include health coverage, wellbeing support, 401(k), disability and life insurance, and other protections; paid time off options vary by location/eligibility.
Application Instructions
- Contact TAEnablement@bms.com if job posting information is missing/incorrect (include Job Title and Requisition number). Inquiries about application status go to “Chat with Ripley”.
- Define and lead BMS’s enterprise Data Risk and Protection strategy aligned to risk appetite, regulatory requirements, and cybersecurity strategy.
- Design and implement the Data Risk and Protection operating model and integrated engagement with Cybersecurity Fusion Center, Legal, HR, Compliance, Audit, and key Business Units.
- Establish, maintain, and continuously evolve the Data Risk & Protection program (policy governance, use-case development, monitoring, detection, response, remediation).
- Develop and execute a multi-year capability roadmap with priorities, milestones, measurable KPIs, and outcome-based risk reduction.
- Lead scaling and maturation of the Data Risk & Protection function and build a high-performing team.
- Provide program status reporting and risk posture updates to senior leadership/governance bodies.
Inside Risk & Threat Analysis
- Operationalize insider threat monitoring and behavioral analytics.
- Define insider threat personas, use cases, and detection scenarios (IP theft, clinical trial data exfiltration, fraud/sabotage, negligent data leakage, Generative AI misuse).
- Collaborate with technical teams to refine monitoring/analytics (UEBA, DLP, CASB, endpoint/identity telemetry, cloud and privileged access monitoring) to improve detection coverage and reduce false positives.
- Oversee insider risk case lifecycle from alert through closure and lessons learned.
- Lead risk-based incident response and root-cause analysis.
- Assess and mitigate data risks from Generative AI and emerging technologies.
Data Loss Prevention (DLP) & Information Protection
- Lead enterprise DLP strategy and operations across endpoints, email, cloud, collaboration platforms (e.g., Microsoft 365/Teams/SharePoint/Copilot, AWS, Google Cloud).
- Define/govern data classification policies and standards for sensitive and regulated data.
- Tune and manage DLP rules/policies/controls.
- Partner with IT Security Architecture/Engineering to embed controls into infrastructure and cloud workflows.
- Establish DLP effectiveness metrics/dashboards and report to senior leadership.
Policy, Governance, Assurance & Culture
- Develop and maintain data risk and protection policies/standards/guidelines (including GenAI usage).
- Establish escalation paths, decision rights, and documentation standards for incidents/insider risk cases.
- Lead/support assurance and audit activities (targeted reviews, thematic assessments, control effectiveness deep-dives).
- Design stakeholder awareness, education, and role-based training.
- Foster trust/accountability and represent BMS in relevant external/regulatory/peer forums.
Qualifications
- Bachelor’s degree required in Computer Science, Information Systems, Cybersecurity, Risk Management, Law, Business Administration, or related field; Master’s preferred.
- Certifications strongly preferred: CISSP, CISM, CISA, CRISC, CDPSE, CFE (or equivalent).
- 10+ years progressive experience in cybersecurity/data risk/insider risk/information protection/security operations; demonstrated leadership of complex enterprise programs (pharma/life sciences or highly regulated preferred).
- Hands-on experience owning DLP/insider threat/UEBA/security investigations.
- Technical fluency with SIEM, UEBA, DLP, EDR/XDR, CASB, IAM and PAM, and cloud security (Microsoft 365 Security, Azure, AWS).
- Familiarity with legal/privacy/employment/ethical considerations and regulations (GDPR/CCPA/HIPAA); must work closely with Legal/HR/Compliance.
- Ability to recruit/develop teams, define operating models/governance, and drive measurable outcomes.
- Experience leading complex cross-functional investigations.
- Strong analytics and communication/influencing skills.
- Ability to handle sensitive/confidential/legally privileged information.
Compensation and Benefits (as stated)
- Princeton, NJ: $188,790–$228,763 base; additional incentive cash/stock may be available (based on eligibility).
- Benefits include health coverage, wellbeing support, 401(k), disability and life insurance, and other protections; paid time off options vary by location/eligibility.
Application Instructions
- Contact TAEnablement@bms.com if job posting information is missing/incorrect (include Job Title and Requisition number). Inquiries about application status go to “Chat with Ripley”.