Executive Director, Data Protection & Privacy

CVS Health Corporation; Scottsdale (AZ); Hybrid; USD 175,000 - 335,000; Full time

Benefits offered by this job

Comprehensive benefits package

Bonus and equity potential

Job summary

CVS Health Corporation seeks an Executive Director of Data Protection & Privacy to own the enterprise program, guiding strategy, architecture, and operations for data protection across the enterprise. You will partner with Legal, Compliance, and executive stakeholders to reduce data exposure and ensure regulatory alignment in a large, highly regulated healthcare environment.

The role demands deep technical fluency in data security, strong executive presence, and proven leadership of data

Qualifications

• Bachelor's degree in a relevant field; advanced degree preferred.
• 15+ years in data protection/privacy or information security.
• Minimum 5 years in senior leadership or executive roles.

Responsibilities

• Define enterprise Data Protection & Privacy strategy, roadmap, and multi-year plan.
• Own DLP design, deployment, and tuning across endpoints, network, email, cloud, SaaS.
• Lead data discovery to inventory and map sensitive data across stores and platforms.
• Establish data classification standards, taxonomy, and labeling across systems.
• Embed privacy-by-design and privacy engineering into data pipelines and AI/ML workflows.
• Ensure HIPAA, GDPR, CCPA/CPRA compliance and audits; support data subject requests.
• Lead insider risk and incident response with cross-functional partners.
• Establish KPIs and executive reporting; partner with legal, risk committees.

Skills

Executive leadership

Data protection

DLP

Privacy engineering

Executive communication

Cross-functional collaboration

Education

Bachelor's degree in CS/IT/Cybersecurity

Master's degree or JD preferred

Tools

DSPM

Cloud data governance (AWS/Azure/GCP)

Data governance platforms

Job description

## Executive Director, Data Protection & PrivacyApply: Remote/Hybrid: AZ - Scottsdale: Full time: Posted Today: End Date: October 27, 2026 (20 days left to apply): R1062881We’re building a world of health around every individual — shaping a more connected, convenient and compassionate health experience. At CVS Health, you’ll be surrounded by passionate colleagues who care deeply, innovate with purpose, hold ourselves accountable and prioritize safety and quality in everything we do. Join us and be part of something bigger – helping to simplify health care one person, one family and one community at a time.**Job Summary**We are seeking a highly experienced and strategic Executive Director of Data Protection and Privacy to own and mature the enterprise data protection program. This role is accountable for the strategy, design, and operational execution of data loss prevention (DLP), data discovery and classification, data privacy engineering, and the broader set of controls that safeguard sensitive, regulated, and member data across the enterprise. The successful candidate will bring deep technical fluency in data security architecture alongside the executive presence to engage senior leadership, legal, compliance, and business stakeholders on data risk. This is a highly visible leadership role responsible for reducing the organization's data exposure risk, ensuring regulatory alignment, and building a scalable, defensible data protection program in a large, complex, highly regulated healthcare environment. **Key Responsibilities*** **Data Protection Strategy:** Define and drive the enterprise Data Protection and Privacy strategy, roadmap, and multi-year investment plan, aligning with business, legal, and regulatory priorities.* **Data Loss Prevention (DLP):** Own the design, deployment, and continuous tuning of enterprise DLP controls across endpoint, network, email, cloud, and SaaS channels to prevent unauthorized exfiltration of sensitive data.* **Data Discovery:** Lead enterprise-wide data discovery efforts to identify, inventory, and map sensitive and regulated data across structured, unstructured, and cloud data stores.* **Data Classification:** Establish and operationalize data classification standards, taxonomy, and labeling schemes, ensuring consistent application across systems, applications, and third-party platforms.* **Data Privacy Engineering:** Partner with engineering and application teams to embed privacy-by-design and privacy-enhancing technologies (encryption, tokenization, masking, anonymization, differential privacy) directly into data pipelines, platforms, and AI/ML workflows.* **Regulatory & Compliance Alignment:** Ensure the data protection program aligns with HIPAA, GDPR, CCPA/CPRA, and other applicable state and federal privacy regulations; partner with Legal and Compliance on data subject requests, breach notification obligations, and audits.* **Insider Risk & Incident Response:** Partner with Detection Engineering and Incident Response to build and refine use cases for detecting data exfiltration, insider risk, and unauthorized data movement; lead data-related incident response and forensics as needed.* **Governance & Reporting:** Establish metrics, KPIs, and executive reporting to measure the maturity and effectiveness of the data protection program; present regularly to senior leadership and risk committees (e.g., GRC SteerCo).* **Team Leadership:** Build, mentor, and scale a high-performing team of data protection and privacy engineers and analysts; foster a culture of technical excellence and business partnership.* **Cross-Functional Collaboration:** Serve as a trusted advisor to executive leadership, Legal, Internal Audit, and business unit stakeholders on emerging data risks, including risks introduced by generative AI and new data platforms.* **Continuous Improvement:** Stay current on emerging data protection technologies, privacy regulations, and industry threats; continuously evolve the program to address new data types, platforms, and business models. **Required Work Experience*** Minimum of 15+ years of experience in data protection, data privacy, or information security, with at least 5 years in a senior leadership or executive-level role.* Proven experience designing, building, and operationalizing enterprise DLP programs across endpoint, network, email, and cloud/SaaS environments.* Demonstrated experience leading enterprise data discovery initiatives, including identifying and inventorying sensitive data across structured and unstructured stores.* Demonstrated experience establishing data classification standards and taxonomy across systems and platforms.* Hands-on experience with data privacy engineering techniques, including encryption, tokenization, data masking, and anonymization.* Strong working knowledge of privacy regulations, including HIPAA, GDPR, CCPA/CPRA, and applicable state privacy laws.* Demonstrated experience leading cross-functional teams, managing enterprise data protection programs, and driving strategic initiatives at the executive level.* Experience advising boards and executive stakeholders on data protection and privacy risk. **Preferred Work Experience*** Experience within a large, highly regulated healthcare, insurance, or financial services organization.* Experience integrating data protection and privacy controls into cloud-native and AI/ML environments (AWS, Azure, GCP).* Experience with data security posture management (DSPM) and modern data governance platforms.* Experience building or maturing an insider risk management program. **Professional Certifications*** Certified Information Privacy Professional (CIPP) – preferred.* Certified Information Privacy Manager (CIPM) – preferred.* Certified Data Privacy Solutions Engineer (CDPSE) – preferred. **Educational Credentials*** Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Law, or a related field; Master's degree or JD preferred.* Ongoing education in data privacy, data security, or related domains is a plus. **Skills and Attributes*** In-depth technical expertise in data protection, DLP, data classification, and privacy engineering concepts and technologies.* Strong executive communication skills, with the ability to translate complex data risk concepts for both technical and non-technical stakeholders.* Proven ability to influence without direct authority, building consensus among stakeholders with competing priorities.* Excellent problem-solving skills, with a focus on scalable, defensible, and business-enabling data protection solutions.* Strong leadership capabilities, with experience building, mentoring, and scaling technical teams.* Sound judgment in balancing data protection rigor with business enablement and user experience.**Pay Range**The typical pay range for this role is:$175,100.00 - $334,750.00This pay range represents the base hourly rate or base annual full-time salary for all positions in the job grade within which this position falls. The actual base salary offer will depend on a variety of factors including experience, education, geography and other relevant factors. This position is eligible for a CVS Health bonus, commission or short-term incentive program in addition to the base pay range listed above. This position also includes an award target in the company’s equity award program. Our people fuel our future. Our teams reflect the customers, patients, members and communities we serve and we are committed to fostering a workplace where every colleague feels valued and that they belong.**Great benefits for great people**We take pride in offering a comprehensive and competitive mix of pay and benefits that reflects our commitment to our colleagues and their families.This full‐time position is eligible for a comprehensive benefits package designed to support the physical, emotional, and financial well‐being of colleagues and their families. The benefits for this position include medical, dental, and vision coverage, paid time off, retirement savings options, wellness programs, and other resources, based on eligibility.Additional details about available benefits are provided during the application process and on Benefits Moments.We anticipate the application window for this opening will close on: 10/27/2026