Senior Director, Cybersecurity Data and Application

Responsibilities:

• Lead a highly experienced team of application security professionals, data security specialists, and cybersecurity experts responsible for enterprise data and application security capabilities. 
•  Develop and execute Penn Medicine's enterprise Data Security and Application Security strategy, operating model, governance framework, and multi-year roadmap. 
•  Lead security architecture reviews, threat modeling, and security design consultations supporting application development, cloud initiatives, data platforms, digital transformation projects, and emerging technology implementations. 
• Oversee the implementation and operation of enterprise application security, data security, API security, database security, and software assurance capabilities. 
•  Establish enterprise policies, standards, architectures, and control frameworks governing data protection, secure software development, API security, software supply chain security, and application security practices. 
• Establish and mature secure software development lifecycle (SSDLC) practices, DevSecOps methodologies, software security standards, and security-by-design principles across the organization. 
• Lead application security testing programs including SAST, DAST, SCA, IAST, API testing, penetration testing coordination, code review, and software supply chain risk management activities. 
• Develop and implement enterprise data protection strategies including data discovery, classification, encryption, tokenization, key management, database security, data loss prevention, and protection of sensitive clinical, research, financial, and business information. 
• Establish governance and security controls protecting structured and unstructured data across on-premises, cloud, SaaS, analytics, research, and AI environments. 
• Support modernization efforts that improve visibility, reduce manual work, standardize security control deployment, and enable faster execution of cybersecurity priorities.
•  Lead software supply chain security initiatives including open-source security, third-party component risk management, CI/CD pipeline security, artifact integrity, and secure code delivery processes. 
• Partner with Application Development, Cloud Security, Infrastructure, IAM, Architecture, Privacy, Compliance, and Data Governance teams to reduce risk and strengthen security posture across digital assets and information ecosystems.
• Lead, mentor, and develop cybersecurity engineering and operations staff through workforce planning, coaching, performance management, succession planning, and skills development. 
• Provide coaching and mentorship to nurture the development of staff in line with organization’s mission and values.
• Build organizational readiness to absorb future cybersecurity engineering capabilities, including identity security engineering, data protection technologies, cloud security platforms, AI security controls, and other emerging protection services as assigned. 
• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures.
• Other duties as assigned to support the unit, department, entity, and health system organization.

Education or Equivalent Experience:

• Bachelor's degree is required. 
• 12+ years of IT experience is required. 
• 7+ years of Cybersecurity experience is required. 
• Master's degree or 7+ years Management/leadership experience is preferred. 
• 10+ years of Cybersecurity experience is preferred.