Cyber Policy Enforcement Lead, VP

About the role

The Cyber Policy Enforcement Lead, VP is responsible for leading the enterprise capability that ensures Cyber Policies and Standards are consistently enforced across the organization.

This role drives accountability for cyber compliance through structured enforcement mechanisms, timely risk-based escalation, and managing the consequence management processes. The role serves as the central coordination point for cyber policy enforcement activities, enabling policy and standard requirements are embedded within business processes, ownership is clearly defined, risks are escalated appropriately, and corrective actions are effectively monitored through resolution.

The VP partners closely with cybersecurity SMEs, business stakeholders, and senior leadership to define enforceable requirements, monitor performance metrics, identify consequence considerations, and deliver clear reporting that enables informed management decision-making.

Key Responsibilities

• Lead the enterprise Cyber Policy Enforcement and Consequence Management capability, enabling consistent application of Cyber Policy and Standard requirements across business units and functions.
• Develop, implement, and continuously enhance policy enforcement, escalation, and consequence management frameworks, processes, and governance mechanisms.
• Partner with SMEs from Global Cybersecurity, Technology, Risk, Compliance, and Business stakeholders to establish enforcement priorities, remediation expectations, and consequence management activities.
• Drive integration of policy enforcement requirements into business processes, governance forums, and risk management practices.
• Facilitate structured engagement forums to review compliance performance, residual risks, remediation progress, and enforcement actions as applicable.
• Prepare and present compliance, enforcement, and risk insights to senior leadership, risk committees, and governance forums.
• Monitor compliance performance and risk trends, identify systemic issues and root causes, and drive sustainable remediation and continuous improvement.
• Define and track key performance indicators (KPIs) and leverage automation opportunities to enhance monitoring, reporting, and workflow efficiency.
• Conduct periodic reviews and updates of enforceable requirements, monitoring expectations, consequence considerations to ensure continued relevance and effectiveness.

Qualifications & Experience

Education

• Bachelor's degree in Cybersecurity, Information Technology, Risk Management, Business Administration, or a related field required.
• Master's degree preferred.
• Relevant industry certifications strongly preferred, such as:
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CRISC (Certified in Risk and Information Systems Control)
• CGEIT (Certified in the Governance of Enterprise IT)
• CISA (Certified Information Systems Auditor)

Experience

• 10+ years of progressive experience in cybersecurity, technology risk, operational risk, governance, risk and compliance (GRC), or related disciplines.
• Demonstrated experience designing and implementing policy enforcement, issue management, escalation, and/or consequence management frameworks within a large, complex organization.
• Strong understanding of cybersecurity governance, risk management, control frameworks, and regulatory expectations within highly regulated industries.
• Experience leading cross-functional initiatives involving cybersecurity SMEs, technology teams, and business partners to achieve risk reduction and compliance objectives.
• Experience managing enterprise-scale stakeholder relationships across business, technology, risk, audit, and executive leadership functions.
• Proven track record of driving accountability and influencing senior stakeholders to address non-compliance, remediate risks, and improve control effectiveness.
• Experience developing and presenting executive-level reporting, risk assessments, metrics, and recommendations to senior management, risk committees, and governance forums.

Knowledge & Skills

• Deep understanding of cybersecurity governance, policy management, standards management, control monitoring, and risk oversight practices.
• Strong knowledge of industry frameworks and regulations, including NIST, ISO 27001, COBIT, FFIEC, SEC, and other relevant regulatory requirements.
• Strong analytical and problem-solving skills with the ability to assess complex risks and recommend practical, risk-based solutions.
• Ability to influence without direct authority and effectively challenge stakeholders while maintaining strong working relationships.
• Strong executive reporting skills, including the ability to translate complex cyber risk, compliance, and enforcement insights into clear, actionable messaging for senior management and governance forums.

Ideal Candidate Profile

The ideal candidate is a strategic, execution-focused cyber governance leader with experience driving enterprise policy enforcement, escalation, and consequence management. They can translate cyber requirements into enforceable actions, measurable outcomes, and clear accountability, while partnering effectively across cyber, technology, business, risk, audit, and leadership teams. They use metrics and executive reporting to surface risks, support decisions, and reinforce a culture of cyber risk ownership.

Salary Range

$120,000 - $202,500 Annual

The range quoted above applies to the role in the primary location specified. If the candidate would ultimately work outside of the primary location above, the applicable range could differ.

Employees are eligible to participate in State Street's comprehensive benefits program, which includes: our retirement savings plan (401K) with company match; insurance coverage including basic life, medical, dental, vision, long-term disability, and other optional additional coverages; paid-time off including vacation, sick leave, short term disability, and family care responsibilities; access to our Employee Assistance Program; incentive compensation including eligibility for annual performance-based awards (excluding certain sales roles subject to sales incentive plans); and, eligibility for certain tax advantaged savings plans.

Job Application Disclosure

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.