Associate Director, Information Security-Data Protection
Alkermes
Summary
We are seeking a highly motivated, hands-on security leader with broad information security expertise and demonstrated technical depth in Data Protection. This senior technical leadership role will be responsible for advancing the strategy, implementation, and continuous improvement of enterprise data protection capabilities across cloud, SaaS, endpoint, and on-premises environments.
Job description
In this role, the Associate Director will partner with Data Governance and business stakeholders to translate enterprise data classification and handling requirements into appropriate technical controls, leveraging Microsoft Purview capabilities and other data protection technologies to support effective implementation and enforcement.
As a senior member of the Information Security leadership team, the Associate Director will also manage a small team of security analysts and provide leadership, oversight and strategic direction across key security programs, including Third-Party Risk Management (TPRM), Security Awareness, Vulnerability Management and Security Operations.
Essential Duties and Responsibilities
- Develop and advance the Information Security strategy and roadmap for data protection, including data classification enablement, data labelling, Data Loss Prevention (DLP), Data Security Posture Management (DSPM), and sensitive-data protection capabilities.
- Partner with Data Governance and business stakeholders to translate enterprise data classification and handling requirements into appropriate technical security controls and data protection capabilities.
- Design, implement, and mature sensitivity labelling capabilities within Microsoft Purview, including label taxonomies and hierarchies, naming conventions, auto-labelling, protection actions, policy configurations, and associated user guidance.
- Lead the implementation, management, and continuous improvement of enterprise DLP and DSPM capabilities across cloud, SaaS, endpoint, and on-premises environments, ensuring controls are aligned with business requirements, regulatory obligations, contractual commitments, and enterprise risk priorities.
- Drive the effectiveness of DLP and related data protection controls by improving detection capabilities, reducing false positives and unnecessary business disruption, and ensuring identified risks are appropriately prioritized and remediated.
- Define and monitor meaningful measures of data protection effectiveness, including DLP/DSPM coverage, policy adoption, alert quality, remediation performance and risk reduction, and provide clear reporting to leadership on risks, control effectiveness, program maturity and improvement priorities.
- Provide leadership for Security Operations, helping establish operational priorities and ensuring effective monitoring, investigation, escalation, and response to security threats and incidents.
- Drive the maturity and effectiveness of the Vulnerability Management program, establishing priorities and ensuring vulnerabilities are appropriately risk-ranked, tracked, remediated, and escalated where required.
- Guide the strategic direction and continued maturity of the Third-Party Risk Management (TPRM) program, ensuring third-party security risks are appropriately identified, assessed, prioritized, escalated, and managed in accordance with enterprise requirements.
- Guide the continued development of the Security Awareness program, ensuring awareness activities address relevant threats and risks, support desired security behaviors, and remain aligned with organizational priorities.
- Evaluate emerging threats, technologies, and regulatory changes and recommend improvements to the organization’s data protection capabilities.
- Lead, mentor, and develop a small team of security professionals, fostering a culture of accountability, collaboration, continuous learning, and professional growth.
- Provide direction and governance for managed security service providers supporting the Information Security program, establishing clear expectations and holding partners accountable for service quality, performance, responsiveness, contractual commitments, and agreed security outcomes.
- Contribute to the leadership and continuous improvement of the Information Security Management System (ISMS), ensuring security policies, standards, risk management processes, controls, metrics, and governance activities remain effective and appropriately maintained.
Requirements
- Bachelor’s degree in computer science, information technology, cybersecurity, or a related field.
- Minimum of eight years of experience in information security, cybersecurity, data security, or a related discipline.
- Minimum of three years of experience in a security leadership, people-management, or significant program-leadership role.
- Demonstrated success leading or materially advancing enterprise DLP and broader data security capabilities.
- Hands-on experience implementing and managing enterprise DLP technologies, with Microsoft Purview strongly preferred.
- Experience protecting sensitive information across hybrid environments that include cloud, SaaS, endpoint, and on-premises technologies.
- Strong working knowledge of data classification, sensitivity labeling, DLP policy development, control tuning, incident investigation, and remediation.
- Demonstrated leadership across multiple Information Security disciplines, including Security Operations, Vulnerability Management, Third-Party Risk Management, and Security Awareness.
- Strong security knowledge across cloud, network, application, identity, and endpoint security.
- Proven ability to partner effectively with technical, Legal, Compliance, Data Governance, Privacy, and business stakeholders.
- Proven ability to manage MSSPs and other external security partners, establishing clear expectations and holding providers accountable for service performance, responsiveness, contractual commitments, and agreed security outcomes.
- Working knowledge of Information Security Management Systems (ISMS), security control frameworks, audit and assurance practices, and remediation of identified control deficiencies.
- Strong written, verbal, presentation, and stakeholder-management skills, including the ability to communicate complex security risks clearly.
- CISSP, CISM, or an equivalent information security certification.
- Advanced experience with Microsoft Purview sensitivity labels, information protection, and DLP capabilities.
- Working knowledge of SIEM platforms and their use in security monitoring, incident investigation, and threat detection.
- Familiarity with vulnerability management processes, including scanning, prioritization, remediation, and risk acceptance.
- Knowledge of applicable data protection and privacy requirements, including GDPR and CCPA.
- Experience supporting information security or data protection programs in a regulated industry.
- Strong problem-solving and analytical capabilities, including the ability to evaluate information from multiple sources, reconcile conflicting requirements, and translate complex issues into actionable recommendations.
- Strong organizational and prioritization skills, with the ability to manage changing priorities effectively in a fast-paced environment.
- High integrity, sound judgment, curiosity, initiative, persistence, and attention to detail.
- Ability to work independently with minimal direction while collaborating effectively with technical and business partners.
Benefits
- Performance pay bonus
- Competitive benefits package
Company overview
Alkermes plc is a global biopharmaceutical company specializing in neuroscience-focused medicines for psychiatric and neurological disorders. Founded in 1987 and headquartered in Dublin, Ireland, the company maintains a significant research and development center in Waltham, Massachusetts, and a manufacturing facility in Wilmington, Ohio. Alkermes has established itself as a leader in developing treatments for complex conditions including schizophrenia, bipolar I disorder, alcohol dependence, and opioid dependence. The company's portfolio includes proprietary commercial products such as Lybalvi (olanzapine/samidorphan), Aristada (aripiprazole lauroxil), and Vivitrol (naltrexone), alongside a robust pipeline of clinical and preclinical candidates targeting neurological disorders like narcolepsy and idiopathic hypersomnia. With approximately 1,800-2,100 employees worldwide, Alkermes combines deep neuroscience expertise with sophisticated development capabilities to address traditionally overlooked or stigmatized conditions, maintaining a patient-centered approach to drug development and commercialization.