Information Protection Lead

Position: Information Protection Lead

Keywords: Insider Risk Management, Insider Threat, Data Protection, DLP, Data Classification, Data Discovery, Data Loss, Data Security

Job Description:
We are seeking a highly motivated and experienced professional to build and lead our Insider Threat & Risk Management team within the Data Security group. This role is critical in identifying, assessing, and mitigating insider risks to protect our firm’s critical data, intellectual property, and operational integrity.
The Consultant/Lead will develop and execute an insider threat program, leveraging behavioral analytics, security tools, and cross-functional collaboration to proactively detect and respond to threats.

Responsibilities:
†Program Development & Leadership: Design and implement a comprehensive insider threat and risk management program aligned with business and security objectives.
†Threat Detection & Response: Utilize data analytics, behavioral indicators, and security tools (e.g., UEBA, DLP, SIEM) to monitor and investigate potential insider threats.
†Familiarity with network security, endpoint protection, and cloud security principles.
†Ability to balance proactive prevention with reactive incident response.
†High ethical standards and discretion when handling sensitive information.
†Demonstrated ability to build and lead teams, with excellent communication and interpersonal skills.
• Risk Assessment & Mitigation: Conduct insider risk assessments, define detection methodologies, and recommend mitigation strategies.
• Collaboration & Stakeholder Engagement: Work closely with Legal, HR, IT, Security Operations, and Compliance teams to develop policies, response frameworks, and training initiatives.
• Incident Handling & Investigations: Lead investigations into potential insider threats, ensuring timely response and remediation while adhering to privacy and legal considerations.
• Security Awareness & Training: Drive awareness programs to educate employees and leaders about insider risks and best practices.
• Regulatory & Compliance Alignment: Ensure the program aligns with industry standards (e.g., NIST, ISO 27001, SOC2) and regulatory requirements.
• Continuous Improvement: Regularly assess and refine the program to adapt to evolving threats and business needs.

Qualifications:
- Bachelor’s degree in information security, Cybersecurity, or related field.
- years of experience in information security, with a focus on information protection, DLP and data protection.
- Strong understanding of information security frameworks, regulations, and standards (e.g., ISO 27001, NIST, GDPR).
- Experience with security technologies such as data classification, DLP, encryption, SIEM, and access controls.
- Professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or equivalent.
- Excellent analytical and problem-solving skills, with the ability to assess risks and recommend effective solutions.
- Strong communication and interpersonal skills to collaborate with various teams and stakeholders.
- Proven track record of successfully implementing and managing information protection programs.