Global Security Compliance & Enforcement Director

EY; Washington (District of Columbia); Hybrid; USD 212,000 - 444,000; Full time

Benefits offered by this job

Hybrid work model

Total rewards package

Generous vacation policy

Job summary

EY is seeking a Director of Global Lead Security Compliance & Enforcement to shape strategy and operating models for Security Compliance within Technology Assurance, Risk & Policy. You will lead a globally distributed team, drive enforcement, and align policy with business needs while advancing automation and risk reduction.

The role requires 12+ years of enterprise experience, strong governance, and the ability to transform complex risk into prioritized remediation and documented risk

Qualifications

• Deep knowledge of cyber security, technology and data risk, policy compliance, control assurance, GRC operations.
• ISO 27001/27002, COBIT, unified compliance frameworks familiarity preferred.
• Ability to translate technical risk into business decisions and measurable risk reduction.

Responsibilities

• Define and execute global security compliance strategy and multi-year roadmap.
• Lead a globally distributed, capability-led organization to address high-risk exposures.
• Own policy compliance enforcement, backlog reduction, and risk acceptance.
• Build data-driven risk intelligence with dashboards and executive reporting.
• Establish AI and DataGuard governance and monitor frontier tech obligations.

Skills

Cyber security

Technology risk

Policy compliance

GRC operations

Executive communication

Education

Cyber security / information security degree

ISO 27001/27002 certification

Job description

EY is seeking a Director of Global Lead Security Compliance & Enforcement to shape strategy and operating models for Security Compliance within Technology Assurance, Risk & Policy. You will lead a globally distributed team, drive enforcement, and align policy with business needs while advancing automation and risk reduction.

The role requires 12+ years of enterprise experience, strong governance, and the ability to transform complex risk into prioritized remediation and documented risk