Executive Director, Info Security

Executive Director, Info Security – reporting to Disney’s Global Information Security (GIS) organization, driving transformation of the InfoSec Governance, Risk & Compliance (GRC) function. The Enterprise Technology & Data mission at Disney focuses on delivering technology solutions that align with business strategies while enabling enterprise efficiency and cross‑company innovation. The GRC team operates as a strategic powerhouse, redefining compliance and risk management to support business decisions across Disney. Responsibilities Transform the GRC program to a dynamic, risk‑intelligence‑led model that informs investment, staffing, and remediation. Develop novel approaches to risk quantification, compliance automation, and governance integration. Partner with GIS Leadership and Segment CTO teams to translate complex risk landscapes into executive‑ready insights. Champion a culture shift that makes risk‑informed thinking intuitive across GIS and the broader enterprise. Oversee the development and operations of Disney’s comprehensive InfoSec Risk Management program, including frameworks, risk registers, and risk‑based prioritization. Establish and operationalize risk tolerance frameworks in collaboration with executive leadership. Build and mature a cybersecurity risk register integrated with threat intelligence and third‑party inputs. Drive risk‑based prioritization across all InfoSec functions, ensuring roadmaps are anchored in defensible risk reduction rationale. Develop executive and board‑level risk reporting that is clear, credible, and decision‑ready. Lead efforts to quantify InfoSec risk in financial terms (FAIR or equivalent) for investment comparisons. Lead third‑party and supply chain risk intelligence beyond questionnaire‑based assessments. Oversee policy development, maintenance, and lifecycle management of enterprise‑wide security policies and standards. Drive automated policy enforcement and integration of governance requirements into technology design lifecycles. Lead policy effectiveness measurement and pioneering forward‑looking policy architecture for emerging technology domains. Oversee annual NIST CSF assessments and report program maturity to senior leadership. Provide governance consultation to segments and business units, ensuring security requirements are actionable. Provide oversight of regulatory, contractual, and policy compliance programs, including SOX 404, PCI DSS, GDPR, etc. Build compliance‑as‑a‑service capabilities for technology teams, reducing compliance burden. Proactively monitor the regulatory horizon and position Disney for upcoming requirements. Lead, develop, and inspire a high‑performing organization of ~40+ professionals across Governance, Compliance, and Risk Management. Must Haves 12+ years of progressive experience in cybersecurity, technology risk, or technology compliance; 3+ years in leadership roles overseeing GRC functions at enterprise scale. Demonstrated track record of building and transforming GRC programs, moving organizations to risk‑driven operating models. Deep expertise across risk management, governance, and compliance frameworks (NIST CSF, 800‑53, ISO27001, PCIDSS4.0, SOX ITGC, GDPR). Proven executive presence with the ability to command a room, build trust with senior leadership, and translate technical risk concepts into business language. Strong experience in risk quantification methodologies (FAIR or equivalent) and driving financial‑terms risk reporting for executive audiences. Expert‑level knowledge of security audit methodologies, controls testing, and assurance processes across ITGCs and automated application controls. Hands‑on familiarity with GRC tooling and platforms (Archer, SailPoint, ServiceNowGRC, or equivalent). Solid understanding of cloud security architecture and compliance implications for major cloud providers (AWS, Azure, GCP). Familiarity with DevSecOps practices and integration of controls into software development and infrastructure pipelines. One or more of the following certifications required: CISSP, CISM, CISA, CRISC. Nice To Haves Experience in the media & entertainment, sports, hospitality, or retail industries. Understanding of unique regulatory and consumer‑facing risks for a global entertainment brand. Big4 accounting firm experience (audit or advisory) with Fortune100 technology and security compliance programs. CPA certification (active or expired). Experience operating in a large, complex, matrixed enterprise with multiple business segments, regulatory regimes, and stakeholder groups. Education and Certifications Bachelor’s degree in Computer Science, Information Systems, Software, Electrical or Electronics Engineering, or comparable field of study. Equivalent work experience may be considered. Compensation Hiring range: $197,500–$265,000 per year (Orlando, FL); $207,400–$278,200 per year (Glendale, CA); $217,300–$291,500 per year (Seattle, WA and New York, NY). Base pay may vary by location and candidate profile. Bonus and/or long‑term incentive units and a full range of benefits may be offered. Location Primary location: Seattle, WA. Alternate: Glendale, CA. Other optional locations may be considered. #J-18808-Ljbffr