Manager, Cybersecurity & Information Protection (US)

Pfizer; United States; On-site; USD 140,000 - 190,000; Full time

Job summary

Pfizer is seeking a Manager, Information Protection & Technology Privacy, to lead and oversee the enterprise information protection program. You will serve as the primary Technology & Cyber Privacy Advisor within the Cyber GRC organization, ensuring data is classified, protected, and handled per Pfizer policies and regulations.

You will collaborate with Data Protection Engineering, Privacy, Legal, IT, Security Operations, and the DPO office to operationalize controls, drive adoption of data

Qualifications

• Bachelor's or higher with required experience or equivalent.
• Strong knowledge of governance, risk, and compliance.
• Experience in regulatory compliance and risk management.
• Experience with data protection regulations in US and LATAM is a plus.

Responsibilities

• Act as a trusted advisor on cybersecurity, information protection, and data privacy matters across the United States.
• Partner with stakeholders to provide pragmatic cybersecurity and information protection guidance for initiatives and projects.
• Assess and manage cybersecurity and information protection risks for business initiatives and third-party engagements.
• Ensure compliance with cybersecurity and data protection regulations across the United States (CCPA/CPRA, HIPAA, state laws).
• Support regulatory inspections, audits, and compliance reviews as required.
• Lead cybersecurity and data protection compliance programs, including regulatory assessments and remediation planning.
• Monitor evolving threats and regulatory developments; drive security awareness and information protection initiatives.
• Define information protection controls to ensure regulatory compliance.

Skills

Information security

Risk management

Regulatory compliance

Project leadership

Stakeholder management

English proficiency

Data protection

Data labeling

Cross-functional collaboration

CISSP/CISA familiarity

Education

Bachelor's degree in Information Security

Master's degree in related field

Associate's degree + 8 years

High school diploma + 10 years

Tools

DLP tools

Data discovery tools

Job description

ROLE SUMMARY

Our Global Cybersecurity Governance, Risk, and Compliance (GRC) team provides comprehensive blueprints for cybersecurity excellence by embedding governance, risk management, and compliance into every layer. The team is responsible for ensuring risk-based decision-making is used and that security, privacy, and regulatory compliance is integrated seamlessly with Pfizer's organization. We are seeking a Manager, Information Protection & Technology Privacy, to lead and oversee the enterprise information protection program and serve as the primary Technology & Cyber Privacy Advisor within the Cyber GRC organization. This role ensures that sensitive data - across intellectual property, regulated data, and confidential business information - is appropriately classified, protected, and handled in alignment with Pfizer policies, regulatory expectations, and risk tolerance. This role partners closely with Data Protection Engineering, Privacy, Legal, IT, Security Operations, and the DPO office to operationalize controls, drive adoption of data protection standards, ensure ongoing compliance across a complex, regulated pharmaceutical environment, and support Business Units in navigating privacy obligations across multiple jurisdictions.

ROLE RESPONSIBILITIES

• Act as a trusted advisor on cybersecurity, information protection, and data privacy matters across the United States.
• Partner with Business, Digital & Technology, Privacy, Legal, and Compliance stakeholders to provide pragmatic cybersecurity and information protection guidance for strategic initiatives, business transformations, and technology projects.
• Assess and manage cybersecurity and information protection risks associated with business initiatives, applications, digital solutions, and third-party engagements.
• Ensure compliance with applicable cybersecurity and data protection regulations across the United States, including CCPA/CPRA, HIPAA, state-level privacy laws (e.g., VCDPA, CPA, CTDPA), and related regulatory requirements.
• Support regulatory inspections, audits, compliance reviews, and regulatory engagements as required.
• Lead cybersecurity and data protection compliance programs, including regulatory assessments, filings, remediation planning, and related compliance activities.
• Monitor emerging cybersecurity threats, regulatory developments, and compliance risks, and drive security awareness, risk management, and information protection initiatives across the organization.
• Support on defining information protection controls for our organization to ensure regulatory compliance.
• Experience with DLP and data discovery tools, as well as data labeling and tagging solutions, including deployment and ongoing support.
• Support in the development of data protection policies and standards.
• Support cybersecurity incident response, escalation, and remediation activities when required.
• This role requires flexibility to collaborate with stakeholders and support business needs across multiple time zones, including occasional coordination with Latin America-based teams.

BASIC QUALIFICATIONS

• Bachelor's degree in Information Security, Computer Science, Information Systems, Risk Management, or a related field with 4+ years of experience in cybersecurity, information security, data protection, privacy, regulatory compliance, risk management, or related disciplines, with at least 2 years in a supervisory or project leadership capacity; OR a master's degree with at least 2 years; OR an associate's degree with 8 years of experience; OR a high school diploma (or equivalent) and 10 years of relevant experience.
• Strong knowledge of cybersecurity governance, risk management, compliance frameworks, and applicable regulatory requirements.
• Strong understanding of cybersecurity and data protection regulations, including CCPA/CPRA, HIPAA, and related U.S. state and federal requirements. Preferred knowledge of data protection and cybersecurity regulations across Latin America (e.g., LGPD in Brazil, Mexico's Federal Law on Protection of Personal Data, and other regional frameworks).
• Experience supporting cybersecurity assessments, audits, regulatory inspections, compliance programs, or risk management initiatives.
• Strong experience and hands on familiarity with technologies to build data discovery, classification and data loss prevention programs will be highly considered during the evaluation process.
• Working knowledge of data encryption concepts and approaches across different environments.
• Strong stakeholder management, communication, and influencing skills, with the ability to work effectively across business and technology functions in a global environment.
• Strong project coordination across business and technical teams.
• Professional proficiency in English; Spanish or Portuguese language is a plus.

PREFERRED QUALIFICATIONS

• Professional certifications such as CISSP, CISA, CISM, CRISC, CIPP/E, CIPM, or equivalent are preferred.
• Experience supporting cyber