Title:  Data Security Program Lead

Astellas' enterprise data protection program across all business functions, including research, clinical, manufacturing and commercial data, covering Microsoft 365, endpoints, web and AI tools. Based in Mexico and supporting stakeholders globally, with a focus on the Americas.

Business Engagement & Discovery: Lead workshops and interviews with data owners and business leaders to understand how each function creates, stores and shares sensitive information. Prepare focused, function-specific materials so sessions are efficient, and build lasting relationships with data owners and business partners.

Crown Jewels & Use Cases: Maintain the register of Astellas' most sensitive data ('crown jewels') with Legal and data owners. Translate business needs into prioritized, documented protection use cases for the Data Security Engineering Lead — what data, which channels, what action and which users — and confirm results with the business before controls are enforced.

Policy & Procedures: Draft and maintain the policies, standards and SOPs for the data security program, including data classification and handling, sensitivity labeling, data loss prevention, exceptions and the use of data in AI tools. Keep them aligned with regulations such as GDPR, HIPAA, Japan's APPI and GxP, and publish them through Astellas' controlled document process.

Exceptions: Review and decide data protection exception requests through the established policy exception process, weighing business justification, compensating controls and expiry dates. Use exception trends to identify where policies, procedures or controls need to change.

User Education & Coaching: Design and deliver role-based training and communications for each control rollout, covering labeling, data loss warnings, safe sharing and responsible use of AI tools. Coach data owners and business partners, follow up with users and teams where data loss or insider risk trends show repeated risky behavior, and build a network of data protection champions across functions and regions.

Adoption & Reporting: Track adoption, user overrides and feedback, and review trends regularly with the Insider Risk team; use these insights to target user engagement and to give the engineering team clear tuning priorities; and report program progress to leadership.

Program Leadership: Own the data protection policy and adoption roadmap; represent the program at steering committee and governance forums; oversee our implementation partner's delivery of policy, workshop and adoption work; and mentor team members and data protection champions.

• Bachelor's degree in Information Systems, Cybersecurity, Business or a related field.

• 10+ years in information security, data protection or data governance, including 5+ years leading a data classification, information protection or data loss prevention program in a global organization.

• Experience leading cross-functional initiatives with global stakeholders and overseeing external partners or vendors, including leading or mentoring a team.

• Proven experience writing and maintaining policies, standards and SOPs, preferably in a regulated industry.

• Experience leading workshops with business stakeholders and translating business needs into clear requirements.

• Experience designing and delivering security awareness, training or change programs.

• Excellent written and spoken English, with the ability to explain data protection in plain language to non-technical audiences.

• Experience in pharmaceutical, life sciences or other regulated industries, including GxP and clinical data.

• Working familiarity with Microsoft Purview concepts (sensitivity labels, data loss prevention) or comparable tools.

• Knowledge of privacy and data protection regulations such as GDPR, HIPAA and Japan's APPI.

• English language skills.

• Certifications such as CIPP, CIPM, CDPSE, CISM or CISSP.