Associate Director, Information Security-Data Protection

We are seeking a highly motivated, hands-on security leader with broad information security expertise and demonstrated technical depth in Data Protection. This senior technical leadership role will be responsible for advancing the strategy, implementation, and continuous improvement of enterprise data protection capabilities across cloud, SaaS, endpoint, and on-premises environments.

In this role, the Associate Director will partner with Data Governance and business stakeholders to translate enterprise data classification and handling requirements into appropriate technical controls, leveraging Microsoft Purview capabilities and other data protection technologies to support effective implementation and enforcement.

As a senior member of the Information Security leadership team, the Associate Director will also manage a small team of security analysts and provide leadership, oversight and strategic direction across key security programs, including Third-Party Risk Management (TPRM), Security Awareness, Vulnerability Management and Security Operations. The role will help ensure these programs operate effectively, risks are appropriately prioritized and escalated, and program owners have clear objectives, accountability and management support.

The successful candidate will bring the technical depth, leadership, and practical judgment needed to strengthen data protection across the enterprise while helping mature the broader Information Security program. This position reports to the Director of Information Security.

Responsibilities

Essential Duties and Responsibilities

Develop and advance the Information Security strategy and roadmap for data protection, including data classification enablement, data labelling, Data Loss Prevention (DLP), Data Security Posture Management (DSPM), and sensitive-data protection capabilities.

Partner with Data Governance and business stakeholders to translate enterprise data classification and handling requirements into appropriate technical security controls and data protection capabilities.

Design, implement, and mature sensitivity labelling capabilities within Microsoft Purview, including label taxonomies and hierarchies, naming conventions, auto-labelling, protection actions, policy configurations, and associated user guidance.

Lead the implementation, management, and continuous improvement of enterprise DLP and DSPM capabilities across cloud, SaaS, endpoint, and on-premises environments, ensuring controls are aligned with business requirements, regulatory obligations, contractual commitments, and enterprise risk priorities.

Drive the effectiveness of DLP and related data protection controls by improving detection capabilities, reducing false positives and unnecessary business disruption, and ensuring identified risks are appropriately prioritized and remediated.

Define and monitor meaningful measures of data protection effectiveness, including DLP/DSPM coverage, policy adoption, alert quality, remediation performance and risk reduction, and provide clear reporting to leadership on risks, control effectiveness, program maturity and improvement priorities.

Provide leadership for Security Operations, helping establish operational priorities and ensuring effective monitoring, investigation, escalation, and response to security threats and incidents.

Drive the maturity and effectiveness of the Vulnerability Management program, establishing priorities and ensuring vulnerabilities are appropriately risk-ranked, tracked, remediated, and escalated where required.

Guide the strategic direction and continued maturity of the Third-Party Risk Management (TPRM) program, ensuring third-party security risks are appropriately identified, assessed, prioritized, escalated, and managed in accordance with enterprise requirements.

Guide the continued development of the Security Awareness program, ensuring awareness activities address relevant threats and risks, support desired security behaviors, and remain aligned with organizational priorities.

Evaluate emerging threats, technologies, and regulatory changes and recommend improvements to the organization’s data protection capabilities.

Lead, mentor, and develop a small team of security professionals, fostering a culture of accountability, collaboration, continuous learning, and professional growth.

Provide direction and governance for managed security service providers supporting the Information Security program, establishing clear expectations and holding partners accountable for service quality, performance, responsiveness, contractual commitments, and agreed security outcomes.

Contribute to the leadership and continuous improvement of the Information Security Management System (ISMS), ensuring security policies, standards, risk management processes, controls, metrics, and governance activities remain effective and appropriately maintained.

Qualifications

Basic Qualifications, Minimum Education & Experience Requirements

Bachelor’s degree in computer science, information technology, cybersecurity, or a related field.

Minimum of eight years of experience in information security, cybersecurity, data security, or a related discipline.

Minimum of three years of experience in a security leadership, people-management, or significant program-leadership role.

Demonstrated success leading or materially advancing enterprise DLP and broader data security capabilities.

Hands-on experience implementing and managing enterprise DLP technologies, with Microsoft Purview strongly preferred.

Experience protecting sensitive information across hybrid environments that include cloud, SaaS, endpoint, and on-premises technologies.

Strong working knowledge of data classification, sensitivity labeling, DLP policy development, control tuning, incident investigation, and remediation.

Demonstrated leadership across multiple Information Security disciplines, including Security Operations, Vulnerability Management, Third-Party Risk Management, and Security Awareness.

Strong security knowledge across cloud, network, application, identity, and endpoint security.

Proven ability to partner effectively with technical, Legal, Compliance, Data Governance, Privacy, and business stakeholders.

Proven ability to manage MSSPs and other external security partners, establishing clear expectations and holding providers accountable for service performance, responsiveness, contractual commitments, and agreed security outcomes.

Working knowledge of Information Security Management Systems (ISMS), security control frameworks, audit and assurance practices, and remediation of identified control deficiencies.

Strong written, verbal, presentation, and stakeholder-management skills, including the ability to communicate complex security risks clearly.

Preferred Qualifications/Personal Attributes

CISSP, CISM, or an equivalent information security certification.

Advanced experience with Microsoft Purview sensitivity labels, information protection, and DLP capabilities.

Working knowledge of SIEM platforms and their use in security monitoring, incident investigation, and threat detection.

Familiarity with vulnerability management processes, including scanning, prioritization, remediation, and risk acceptance.

Knowledge of applicable data protection and privacy requirements, including GDPR and CCPA.

Experience supporting information security or data protection programs in a regulated industry.

Strong problem-solving and analytical capabilities, including the ability to evaluate information from multiple sources, reconcile conflicting requirements, and translate complex issues into actionable recommendations.

Strong organizational and prioritization skills, with the ability to manage changing priorities effectively in a fast-paced environment.

High integrity, sound judgment, curiosity, initiative, persistence, and attention to detail.

Ability to work independently with minimal direction while collaborating effectively with technical and business partners.

The annual base salary for this position ranges from $178,000 to $195,000. In addition, this position is eligible for an annual performance pay bonus.  Exact compensation may vary based on skills, training, knowledge, and experience. Alkermes offers a competitive benefits package.  Additional details can be found on our careers website: 

Alkermes has recently adopted a hybrid working environment to support and meet the needs of employees and this role will operate in a flexible environment with 60% of time in the office and 40% from home. This position is eligible for the hybrid workplace model, requiring work to be completed onsite at our Waltham, MA office at least 3 days per week. This role is not eligible for fully remote work. 

#LI-AH1