Director OF Information Security

At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world. The opportunity The Global Lead Security Compliance & Enforcement owns the strategy, operating model, and outcomes for the global Security Compliance function within Technology Assurance, Risk & Policy. The role transforms Security Compliance into a proactive, intelligence-driven, and enforcement-capable organization that reduces risk debt, sustains critical governance, risk, and compliance operations and provides defensible, audit-ready governance. The Director creates clear global accountability for security compliance and converts fragmented or ambiguous risk situations into prioritized action. Using policy, compliance-posture data, risk appetite, escalation protocols, and executive decision forums, the role addresses situations in which ownership, remediation capacity, enforcement authority, or risk tolerance are unclear. This includes clearing persistent enforcement backlogs, sequencing scarce specialist capacity across concurrent initiatives, expanding control monitoring, resolving technology-lifecycle exposure, and establishing governance for frontier AI and DataGuard obligations. Working with CTOs, Service Line Quality Leaders, Technology Risk & Compliance, Information Security leadership, risk and control owners, technology teams, and audit and governance stakeholders, the Director balances policy requirements with business impact, technology delivery, client confidence, and documented risk acceptance. The role sets the multi-year roadmap, leads a globally distributed organization, and provides senior leaders with decision-quality information on compliance posture, risk trends, enforcement, and remediation. Key Responsibilities Strategic Leadership Define and execute the global Security Compliance strategy, target operating model, multi-year roadmap, priorities, performance measures, and resource plan in alignment with risk appetite and business objectives. Lead and develop a globally distributed, capability-led organization that proactively addresses the highest-risk exposures while sustaining business-as-usual GRC operations and talent succession. Compliance Governance & Enforcement Own global policy compliance and the Non-Compliance Consequence Framework, including consistent enforcement, escalation, investigation, corrective action, backlog reduction, and documented risk acceptance. Risk Intelligence & Remediation Build data-driven risk intelligence and expand control monitoring and assurance through clear evidence, metrics, trends, dashboards, executive reporting, and risk burn-down tracking. Direct remediation and technology-lifecycle governance, including out-of-SLA vulnerability triage, End-of-Life exposure, exceptions, and emerging AI and DataGuard obligations. AI Governance & Emerging Technologies Establish compliance governance, monitoring, accountability, and reporting for frontier AI, DataGuard, and other emerging-technology obligations. Stakeholder & Executive Engagement Partner with CTOs, Service Line Quality Leaders, risk, security, audit, governance, and technology teams to balance policy, business impact, client confidence, and delivery, while advancing automation and continuous improvement. Supervision Responsibilities The Director reports to the Global Leader, Technology Assurance, Risk & Policy within Information Security and leads the global Security Compliance function. Knowledge And Skills Requirements Deep knowledge of cyber security, technology and data risk, policy compliance, control assurance, GRC operations, enterprise remediation, exception governance, and risk acceptance. Practical understanding of ISO 27001/27002, ISO 31000, COBIT, unified compliance frameworks, audit expectations, and enterprise control obligations. Ability to translate technical exposure and compliance data into business risk, executive action, documented decisions, and measurable risk reduction. Proven capability to design and lead global operating models, portfolio governance, monitoring, evidence, metrics, dashboards, executive reporting, and automation enablement. Strong judgment in enforcement, escalation, corrective action, remediation prioritization, business continuity, and allocation of scarce specialist capacity in a matrixed organization. Executive communication and stakeholder partnership skills across senior leaders, client-serving teams, technology delivery, risk and control owners, audit, and governance forums. Job Requirements Demonstrated ability to lead a global security compliance, technology risk, control assurance, or GRC function of comparable complexity and strategic scope. Demonstrated experience resolving complex cross-functional issues through data, policy, risk appetite, escalation protocols, and executive decision forums. Experience establishing priorities and measurable outcomes, managing a portfolio of concurrent initiatives, and allocating specialist capacity while continuous operations remain active. Experience directing policy-compliance enforcement, non-compliance remediation, control monitoring, technology-lifecycle risk, exception governance, and risk-acceptance processes. Ability to engage directly with executive technology, quality, risk, security, service-line, audit, and governance stakeholders and present compliance posture, trends, and remediation progress. Ability to lead distributed teams, coach leaders and staff, align responsibilities and objectives to capability, and develop succession and talent strategies. Education And Certification Requirements A relevant educational background in cyber security, information security, technology risk, IT or data risk management, governance, compliance, or a related discipline is expected. Relevant professional certifications in information security, technology risk, governance, audit, or compliance are preferred, particularly credentials aligned with ISO 27001/27002, ISO 31000, COBIT, or unified compliance frameworks. Experience Requirements A minimum of 12 years of professional experience is required in complex, enterprise-scale security compliance, technology risk, policy, control assurance, GRC operations, or remediation environments. Candidates should demonstrate experience leading distributed teams and capability leaders, operating in a matrixed global organization, advising senior executives, transforming operating models, managing enforcement and escalation, expanding monitoring and assurance, and converting ambiguous cross-functional risks into prioritized remediation or documented risk acceptance. What We Offer You The compensation ranges below are provided in order to comply with United States pay transparency laws. Other geographies will follow their local salary guidelines, which may not be a direct conversion of published US salary ranges. At EY, we’ll develop you with future-focused skills and equip you with world-class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams. Learn more. We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job in all geographic locations in the US is $212,400 to $443,900. The base salary range for New York City Metro Area, Washington State and California (excluding Sacramento) is $254,900 to $504,500. Individual salaries within those ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. Join us in our team-led and leader-enabled hybrid model. Our expectation is for most people in external, client serving roles to work together in person 40-60% of the time over the course of an engagement, project or year. Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being. EY | Building a better working world EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets. Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow. EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories. EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law. EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY’s Talent Shared Services Team (TSS) or email the TSS at View email address on click.appcast.io. #J-18808-Ljbffr