Principal – Cyber Security

Join to apply for the Principal – Cyber Security role at Ally
.

Ally Financial only succeeds when its people do - and that’s more than some cliché job postings. We live this stuff! We see our people as people – with interests, families, friends, dreams, and causes that are all important to them. Our focus is on the health and safety of our teammates as well as work-life balance and diversity and inclusion.

From generous benefits to a variety of employee resource groups, we strive to build paths that encourage employees to stretch themselves professionally. We want to help you grow, develop, and learn new things. You’re constantly evolving, so shouldn’t your opportunities be, too?

Work Schedule
A role designated as fully on-site, hybrid, or fully remote. Hybrid roles are generally expected to be in the office certain number of days per week as indicated by your manager. Work requirements subject to change based on leader discretion and/or business need.

At Ally, you get a startup feel, but experience the benefits of a company that has worked out the kinks and is fulfilling its purpose. We are always evolving, and we value diverse thinking, collaboration, and challenge ourselves to think bigger to deliver customer‑obsessed tech solutions.

The Principal of Cyber Security position is a member of the Information Protection and Risk Management team. The role works closely with other IPRM program members to develop and implement a comprehensive approach to managing security risks  requires a strong technical background and the ability to work with IT organization and business management to align priorities with key business objectives. The position is a mid‑level to senior‑level highly technical role driving strategic programs in data security, privacy, governance, and cyber resiliency, and serves as a key advisor on data protection and privacy initiatives.

• Lead Data Security & Privacy Initiatives:
  Work with the Director of Cyber Security to ensure the security program addresses identified risks and business requirements.
• Manage threat landscape analysis and provide realistic overhead of risks and threats in the enterprise environment.
• Oversee enterprise‑wide data discovery and classification efforts to accurately identify and categorize sensitive information across structured and unstructured data sources.
• Champion data obfuscation strategies, including masking, tokenization, de‑identification, and redaction, to safeguard confidential data.
• Develop and maintain data privacy controls aligned with regulatory requirements (PCI, SOX, GLBA, NYDFS, Sarbanes‑Oxley, etc.) and internal policies.
• Collaborate with Risk Assessment and Data Governance teams to remediate risk findings and implement mitigation strategies.
• Ensure the organization’s data security posture meets audit and regulatory standards; prepare and validate checklists for compliance reviews and regulatory exams.
• Design and implement data security solutions for on‑premises and cloud environments (AWS, Azure).
• Manage deployment and sustainment of data security technologies (e.g., Delphix, IBM Optim, BigID, Informatica, Gen Rocket).
• Guide the team in developing automated tools for data profiling, masking, and reporting.
• Measure KPIs and KRIs against defined objectives and proactively predict potential critical risks.
• Mentor and develop team members, fostering continuous improvement and innovation.
• Build strong relationships with business, IT, and compliance stakeholders to align security objectives with organizational goals.
• Communicate effectively with technical and non‑technical partners, including senior leadership.
• Perform data analysis, track workflow burndown to meet milestones, and deliver KPI/KRI reporting.

• 5+ years in IT, data security, privacy, or related fields.
• Bachelor’s degree in Computer Science, Cyber Security, a related field, or equivalent experience.
• Proven experience in data discovery, classification, and obfuscation.
• Strong understanding of regulatory processes and compliance frameworks (PCI, SOX, GLBA, NYDFS, Sarbanes‑Oxley).
• Hands‑on expertise with data security technologies…