Senior Director, Data & Application Security

Penn Medicine; Philadelphia (Philadelphia County); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Penn Medicine is a leading academic medical center committed to care, research, and education. The Senior Director of Cybersecurity Data & Application Security will provide strategic leadership for enterprise data and application security programs, guiding DevSecOps and secure software practices across on-premises and cloud environments.

Reporting to the CISO, you will partner with IT, architecture, privacy, compliance, and clinical operations to balance innovation with risk management while

Qualifications

• Bachelor's degree is required.
• 12+ years of IT experience is required.
• 7+ years of Cybersecurity experience is required.
• Master's degree or 7+ years Management/leadership experience is preferred.
• 10+ years of Cybersecurity experience is preferred.

Responsibilities

• Lead a highly experienced team of application security professionals, data security specialists, and cybersecurity experts responsible for enterprise data and application security capabilities.
• Develop and execute Penn Medicine's enterprise Data Security and Application Security strategy, operating model, governance framework, and multi-year roadmap.
• Lead security architecture reviews, threat modeling, and security design consultations supporting application development, cloud initiatives, data platforms, digital transformation projects, and emerging technology implementations.
• Oversee the implementation and operation of enterprise application security, data security, API security, database security, and software assurance capabilities.
• Establish enterprise policies, standards, architectures, and control frameworks governing data protection, secure software development, API security, software supply chain security, and application security practices.
• Establish and mature secure software development lifecycle (SSDLC) practices, DevSecOps methodologies, software security standards, and security-by-design principles across the organization.
• Lead application security testing programs including SAST, DAST, SCA, IAST, API testing, penetration testing coordination, code review, and software supply chain risk management activities.
• Develop and implement enterprise data protection strategies including data discovery, classification, encryption, tokenization, key management, database security, data loss prevention, and protection of sensitive clinical, research, financial, and business information.
• Establish governance and security controls protecting structured and unstructured data across on-premises, cloud, SaaS, analytics, research, and AI environments.
• Support modernization efforts that improve visibility, reduce manual work, standardize security control deployment, and enable faster execution of cybersecurity priorities.
• Lead software supply chain security initiatives including open-source security, third-party component risk management, CI/CD pipeline security, artifact integrity, and secure code delivery processes.
• Partner with Application Development, Cloud Security, Infrastructure, IAM, Architecture, Privacy, Compliance, and Data Governance teams to reduce risk and strengthen security posture across digital assets and information ecosystems.
• Lead, mentor, and develop cybersecurity engineering and operations staff through workforce planning, coaching, performance management, succession planning, and skills development.
• Provide coaching and mentorship to nurture the development of staff in line with organization’s mission and values.
• Build organizational readiness to absorb future cybersecurity engineering capabilities, including identity security engineering, data protection technologies, cloud security platforms, AI security controls, and other emerging protection services as assigned.
• Performs duties in accordance with Penn Medicine and entity values, policies, and procedures.
• Other duties as assigned to support the unit, department, entity, and health system organization.

Skills

IT leadership

Cybersecurity strategy

Threat modeling

SSDLC

Cloud security

Education

Bachelor's degree

Master's degree or leadership experience

Tools

SAST

DAST

SCA

Cloud security platforms

Job description

Penn Medicine is a leading academic medical center committed to care, research, and education. The Senior Director of Cybersecurity Data & Application Security will provide strategic leadership for enterprise data and application security programs, guiding DevSecOps and secure software practices across on-premises and cloud environments.

Reporting to the CISO, you will partner with IT, architecture, privacy, compliance, and clinical operations to balance innovation with risk management while