Senior Director, Cybersecurity Data and Application

Penn Medicine; Philadelphia (Philadelphia County); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Penn Medicine is a leading academic medical center committed to care, research, and education. The Senior Director of Cybersecurity Data & Application Security will provide strategic leadership for enterprise data and application security programs, guiding DevSecOps and secure software practices across on-premises and cloud environments.

Reporting to the CISO, you will partner with IT, architecture, privacy, compliance, and clinical operations to balance innovation with risk management while

Qualifications

• Bachelor's degree is required.
• 12+ years of IT experience is required.
• 7+ years of Cybersecurity experience is required.
• Master's degree or 7+ years Management/leadership experience is preferred.
• 10+ years of Cybersecurity experience is preferred.

Responsibilities

• Lead a highly experienced team of application security professionals, data security specialists, and cybersecurity experts responsible for enterprise data and application security capabilities.
• Develop and execute Penn Medicine's enterprise Data Security and Application Security strategy, operating model, governance framework, and multi-year roadmap.
• Lead security architecture reviews, threat modeling, and security design consultations supporting application development, cloud initiatives, data platforms, digital transformation projects, and emerging technology implementations.
• Oversee the implementation and operation of enterprise application security, data security, API security, database security, and software assurance capabilities.
• Establish enterprise policies, standards, architectures, and control frameworks governing data protection, secure software development, API security, software supply chain security, and application security practices.
• Establish and mature secure software development lifecycle (SSDLC) practices, DevSecOps methodologies, software security standards, and security-by-design principles across the organization.
• Lead application security testing programs including SAST, DAST, SCA, IAST, API testing, penetration testing coordination, code review, and software supply chain risk management activities.
• Develop and implement enterprise data protection strategies including data discovery, classification, encryption, tokenization, key management, database security, data loss prevention, and protection of sensitive clinical, research, financial, and business information.
• Establish governance and security controls protecting structured and unstructured data across on-premises, cloud, SaaS, analytics, research, and AI environments.
• Support modernization efforts that improve visibility, reduce manual work, standardize security control deployment, and enable faster execution of cybersecurity priorities.
• Lead software supply chain security initiatives including open-source security, third-party component risk management, CI/CD pipeline security, artifact integrity, and secure code delivery processes.
• Partner with Application Development, Cloud Security, Infrastructure, IAM, Architecture, Privacy, Compliance, and Data Governance teams to reduce risk and strengthen security posture across digital assets and information ecosystems.
• Lead, mentor, and develop cybersecurity engineering and operations staff through workforce planning, coaching, performance management, succession planning, and skills development.
• Provide coaching and mentorship to nurture the development of staff in line with organization’s mission and values.
• Build organizational readiness to absorb future cybersecurity engineering capabilities, including identity security engineering, data protection technologies, cloud security platforms, AI security controls, and other emerging protection services as assigned.
• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures.
• Other duties as assigned to support the unit, department, entity, and health system organization.

Skills

IT leadership

Cybersecurity strategy

Threat modeling

SSDLC

Cloud security

Education

Bachelor's degree

Master's degree or leadership experience

Tools

SAST

DAST

SCA

Cloud security platforms

Job description

Description

Penn Medicine is dedicated to our tripartite mission of providing the highest level of care to patients, conducting innovative research, and educating future leaders in the field of medicine. Working for this leading academic medical center means collaboration with top clinical, technical and business professionals across all disciplines.

Today at Penn Medicine, someone will make a breakthrough. Someone will heal a heart, deliver hopeful news, and give comfort and reassurance. Our employees shape our future each day. Are you living your life's work?

Entity: Corporate Services

Department: IS - Cybersecurity

Location: 3535 Market Street/Hybrid

Summary

The Senior Director, Cybersecurity Data & Application Security reports to the Chief Information Security Officer (CISO) and provides strategic, operational, and organizational leadership for Penn Medicine's enterprise Data Security and Application Security programs.

This position serves as the enterprise authority for Data Security, Application Security, DevSecOps, Software Supply Chain Security, API Security, Database Security, Secure Development Practices, and Data Protection Engineering. The Senior Director partners closely with Information Services, Enterprise Architecture, Application Development, Data & Analytics, Cloud, Privacy, Compliance, Research, and Clinical Operations leaders to enable innovation while reducing organizational cyber risk.

The Senior Director leads teams responsible for application security, secure software development, DevSecOps, software supply chain security, API security, data protection engineering, database security, data security architecture, security testing, code assurance, and emerging digital security capabilities.

Responsibilities

• Lead a highly experienced team of application security professionals, data security specialists, and cybersecurity experts responsible for enterprise data and application security capabilities.
• Develop and execute Penn Medicine's enterprise Data Security and Application Security strategy, operating model, governance framework, and multi-year roadmap.
• Lead security architecture reviews, threat modeling, and security design consultations supporting application development, cloud initiatives, data platforms, digital transformation projects, and emerging technology implementations.
• Oversee the implementation and operation of enterprise application security, data security, API security, database security, and software assurance capabilities.
• Establish enterprise policies, standards, architectures, and control frameworks governing data protection, secure software development, API security, software supply chain security, and application security practices.
• Establish and mature secure software development lifecycle (SSDLC) practices, DevSecOps methodologies, software security standards, and security-by-design principles across the organization.
• Lead application security testing programs including SAST, DAST, SCA, IAST, API testing, penetration testing coordination, code review, and software supply chain risk management activities.
• Develop and implement enterprise data protection strategies including data discovery, classification, encryption, tokenization, key management, database security, data loss prevention, and protection of sensitive clinical, research, financial, and business information.
• Establish governance and security controls protecting structured and unstructured data across on-premises, cloud, SaaS, analytics, research, and AI environments.
• Support modernization efforts that improve visibility, reduce manual work, standardize security control deployment, and enable faster execution of cybersecurity priorities.
• Lead software supply chain security initiatives including open-source security, third-party component risk management, CI/CD pipeline security, artifact integrity, and secure code delivery processes.
• Partner with Application Development, Cloud Security, Infrastructure, IAM, Architecture, Privacy, Compliance, and Data Governance teams to reduce risk and strengthen security posture across digital assets and information ecosystems.
• Lead, mentor, and develop cybersecurity engineering and operations staff through workforce planning, coaching, performance management, succession planning, and skills development.
• Provide coaching and mentorship to nurture the development of staff in line with organization’s mission and values.
• Build organizational readiness to absorb future cybersecurity engineering capabilities, including identity security engineering, data protection technologies, cloud security platforms, AI security controls, and other emerging protection services as assigned.
• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures.
• Other duties as assigned to support the unit, department, entity, and health system organization.

Education or Equivalent Experience

• Bachelor's degree is required.
• 12+ years of IT experience is required.
• 7+ years of Cybersecurity experience is required.
• Master's degree or 7+ years Management/leadership experience is preferred.
• 10+ years of Cybersecurity experience is preferred.

We believe that the best care for our patients starts with the best care for our employees. Our employee benefits programs help our employees get healthy and stay healthy. We offer a comprehensive compensation and benefits program that includes one of the finest prepaid tuition assistance programs in the region. Penn Medicine employees are actively engaged and committed to our mission. Together we will continue to make medical advances that help people live longer, healthier lives.

Live Your Life's Work

We are an Equal Opportunity employer. Candidates are considered for employment without regard to race, ethnicity, color, sex, sexual orientation, gender identity, religion, national origin, ancestry, age, disability, marital status, familial status, genetic information, domestic or sexual violence victim status, citizenship status, military status, status as a protected veteran or any other status protected by applicable law.