Director, Data Security & Governance

Director, Data Security & Governance

arrivia · Remote (US) · Full-time

About arrivia

arrivia specializes in making brands better through the power of travel, powering loyalty and membership travel programs. Formed from the merger of ICE, SOR Technology, and WMPH Vacations, the company brings more than 55 years of combined experience and operates on both US coasts and around the world.

About the Role

This role protects arrivia's data wherever it lives, through classification, data loss prevention, and encryption, the controls that most often separate a clean audit from the highest-severity finding. You will own information classification, labelling, and handling under ISO/IEC 27001 and the DAMA-DMBOK data security knowledge area; DLP across egress channels with PII and SOC adherence reviews; Data Security Posture Management across cloud, SaaS, and endpoints; cryptography standards, key management, HSM, and the full key lifecycle including tokenization; data-access governance, insider-risk, and enterprise retention and deletion; and data residency and sovereignty controls with records management and eDiscovery. On the AI side, you will own data governance for AI, training-data and RAG-source controls and prompt and response DLP. You will report to the CIO and lead the data security team.

What You'll Do

• Own information classification, labelling, and handling (ISO/IEC 27001 A.5.12 to A.5.14) and the DAMA-DMBOK data security knowledge area.
• Own DLP across egress channels, plus PII and SOC adherence reviews and controls.
• Own Data Security Posture Management across cloud, SaaS, and endpoints.
• Own cryptography standards, key management, HSM, and key lifecycle, including tokenization.
• Own data-access governance, insider-risk, enterprise retention and deletion, and data residency and sovereignty with records management and eDiscovery.
• Own data governance for AI: training-data and RAG-source controls and prompt and response DLP to prevent leakage to LLMs.

What We're Looking For

• A degree in computer science, cybersecurity, or a related field, or a minimum of 7 years in security; 5+ years in data security and governance, including team leadership.
• Hands-on experience with data classification and DLP tooling (Microsoft Purview, Symantec/Broadcom, Forcepoint) across email, endpoint, and cloud.
• Experience deploying DSPM across cloud, SaaS, and endpoints.
• Strong knowledge of encryption for data at rest and in transit, with hands-on key management, HSM, and key-lifecycle experience including tokenization.
• Experience with data-access governance, insider-risk, and enterprise data retention; knowledge of data residency and sovereignty and records management and eDiscovery.
• Working knowledge of data governance for AI; strong understanding of ISO 27001/27701, HIPAA, PII, PCI, and GDPR. CISSP required; CIPT, CDPSE, or CISM preferred.

Compensation and Benefits

$166,000-$249,000. Remote within the US, leading the data security team and reporting to the CIO.

How to Apply

To apply for this role, you must create an account on provn.co and submit all required application artifacts. Resume only applications may be considered, but candidates who complete a full application are reviewed with priority.

How hiring works here

Referrals are king for getting an interview. But what if you don't have a referral? Applying with Provn is designed to help you get more interviews. Instead of sending a cold resume into an ATS and waiting, you will complete a challenge built by arrivia and submit a short video walking through your approach. No time limit. No timers. No restrictions on AI usage. Show how you build with AI.

Why that works in your favor:

• You show how you actually build and ship with coding agents, instead of hoping a resume communicates your skill clearly.
• Your judgment with AI becomes visible, which no "proficient with AI coding agents" resume bullet can prove.
• One challenge puts you in front of the security team, scored on the work. Priority without a referral!

The hiring manager reviews every completed submission, and strongest candidates go straight to an interview round. No referral needed. Performance over pedigree. Proof over polish.

For this role, the challenge is a significant part of your candidacy. If you have been looking for a foot in the door, a chance to show what you can do, if you have ever felt like all you needed was ten minutes with the hiring manager to prove yourself, this is that opportunity.