Chief Privacy Officer and Assistant Vice President

Required Qualifications (as evidenced by an attached resume): 
Juris Doctor (or foreign equivalent) from an accredited law school and an active bar admission in at least one U.S. state. Seven (7) years of full-time progressive privacy and data protection experience. Hands-on experience managing and interacting with federal & state compliance regulators and international privacy laws. Must have, keep and maintain the appropriate valid NYS Driver’s License; have a motor vehicle record which is free from major violations or a pattern of repeat violations. (***Out-of-State Applicants, see "Special Notes”).

Preferred Qualifications:
Ten (10) years of full-time progressive privacy and data protection experience. Professional privacy certification (CIPP, CIPM, CIPT, or equivalent). Experience in managing privacy requirements as a service provider to various regulated entities, such as higher education, healthcare entities (e.g., HIPAA-regulated entities), banking (e.g., GLBA-regulated entities), etc. International privacy experience. Knowledge of data governance frameworks and master data management (MDM) practices. Experience with privacy tools and platforms (e.g., OneTrust, TrustArc, BigID). Familiarity with privacy-enhancing technologies (PETs) such as data anonymization, pseudonymization, and tokenization. 

Brief Description of Duties: 
The Chief Privacy Officer (CPO) and Assistant Vice President will lead the development, implementation, and oversight of a comprehensive privacy program that supports Stony Brook University’s academic, research, clinical, and administrative functions. Reporting to the Vice President for Enterprise Risk Management, the CPO and AVP provides strategic leadership across the university’s ecosystem and ensures compliance with federal, state, and international privacy laws, institutional policies, and sponsor requirements. Acting as a trusted advisor, this executive will collaborate closely with stakeholders in ERM, legal, IT security, academic affairs, research administration, and clinical operations to strengthen the university’s privacy framework. We are seeking a visionary and ethical leader who combines deep expertise in global privacy laws, information security, and data operations with exceptional leadership acumen. The ideal candidate will have a proven ability to build and develop high-performing teams, foster a culture of compliance and accountability, and inspire confidence across all levels of the organization. The CPO and AVP will partner with Stony Brook Medicine privacy leaders on HIPAA compliance and privacy initiatives to ensure coordination and consistency across institutional privacy practices. With strong strategic thinking and sound business judgment, they will translate complex regulatory requirements into actionable enterprise solutions, leveraging advanced privacy management tools to drive measurable results. A persuasive communicator and trusted advisor, the CPO and AVP will demonstrate urgency, integrity, and an unwavering commitment to advancing the mission, vision, and values of Stony Brook University while enabling innovation, mitigating risk, and maintaining stakeholder trust. The selected candidate should also have a proven track record of building and/or implementing enterprise-wide privacy programs.

• Strategic Leadership & Governance: 
  • Develop and execute the organization's privacy vision, strategy, and roadmap.
  • Partner with executive leadership to integrate privacy considerations into business strategy.
  • Identify and recommend privacy management tools. 
  • Serve as the organization's primary privacy subject matter expert to regulators and stakeholders. 
  • Establish privacy governance frameworks and accountability structures. 
  • Build, lead and mentor a team of privacy professionals. 
  • Stay current with technological advances that impact privacy practices, including assessing privacy implications of AI, machine learning, and other emerging technologies. 
  • Develop privacy-by-design principles for technology implementations.
  • Champion enterprise-wide privacy governance by aligning policies and decision-making with institutional strategy.