This role has hybrid work pattern, 3 days per week from our Warsaw office with 2 days remote.
General Description:
BeOne is seeking a Senior Manager, Sensitive Data Discovery and Governance to operationalize and scale the enterprise’s sensitive data classification capabilities and support information & records retention lifecycle management capabilities, delivered through the Data Sentinel platform. This role sits within the Enterprise Data & Analytics Governance function and is responsible for the day-to-day execution of sensitive data discovery, classification, tagging, and supports information and record governance across business and data domains operating in a federated governance model.
Working across the Heads of Enterprise Data & Analytics Governance, Information Protection Management, and Information Governance, this position acts as the Subject Matter Expert (SME) for sensitive data discovery and classification, translating regulatory requirements into practical, adoptable, and automated governance processes. The initial mandate centers on enterprise sensitive data classification and retention controls aligned to the U.S. Department of Justice (DOJ) Data Security Program / Data Security Rule (Executive Order 14117), with a forward roadmap that extends these capabilities to GDPR, PIPL, and additional global privacy and records regulations.
Leveraging the Data Sentinel platform, this role will stand up and continuously improve automated sensitive data discovery, classification, labeling, and retention lifecycle workflows; help lead managed service providers; and provide transparent reporting on coverage, risk reduction, and key performance indicators (KPIs). The position requires strong cross-functional partnership with Business, IT, Security, Legal, Privacy, Compliance, and Information Governance stakeholders to ensure sensitive data is identified, classified, protected, retained, and defensibly disposed of in accordance with regulatory obligations.
Essential Functions of the Job:
- Act as SME for sensitive data classification and information & records retention lifecycle management, contributing to operating models, policies, standards, procedures, and best practices.
- Operationalize the Data Sentinel platform to deliver automated sensitive data discovery, classification, labeling/tagging, and retention lifecycle workflows across the enterprise data estate.
- Lead and execute key initiatives, including:
- Enterprise sensitive data classification and tagging aligned to the DOJ Data Security Rule (EO 14117), including classification schemes and Information Rights Management (IRM) controls for regulated bulk sensitive personal and government-related data.
- Parterning with Information Governance to operationalize record retention schedules, legal holds, archival, and defensible disposition
- Roadmap development extending data discovery & classification to other regulatory compliance such as GDPR, PIPL, and other privacy and other regulations.
- Lead the validation to configure and tune Data Sentinel discovery rules, classifiers, and policies to maximize precision, coverage, and adoption across unstructured and structured data domains.
- Onboard business and data domains into sensitive data governance processes, including role enablement, training, and adoption of governance tools and workflows.
- Partner with Information Protection and Privacy to align classification outputs with DLP, access controls, and regulatory reporting requirements.
- Coordinate and provide direction to managed service providers supporting discovery, classification remediation, and retention operations.
- Influence and drive adoption of sensitive data and records practices without direct authority by partnering with cross-functional and domain teams to embed governance into day-to-day execution.
- Establish, monitor, and report on KPIs — classification coverage, sensitive data exposure and risk reduction, retention schedule adoption, disposition completion, and remediation throughput.
- Explore opportunities to incorporate emerging AI/ML techniques to improve classification accuracy and automate records lifecycle processes.
- Provide clear communication of classification and retention essentials to technical and non-technical audiences, and report regularly on initiative status, risks, and outcomes to the Heads of Enterprise Data & Analytics Governance, Information Protection, and Information Governance.
Qualifications:
Required Qualifications
- Bachelor’s Degree with 7+ years of experience in data governance, information governance, records management, data privacy, or sensitive data management roles.
- Demonstrated experience delivering sensitive data discovery and classification programs within a federated, matrixed, or enterprise-scale operating model.
- Hands-on experience with sensitive data discovery/classification platforms — e.g., BigID, Securiti, Microsoft Purview, Varonis, Informatica, or equivalent Data Sentinel–class tooling.
- Working knowledge of information and records retention lifecycle management, including retention schedules, legal holds, and defensible disposition.
- Proven ability to influence outcomes without formal authority, evidenced by successful adoption of governance processes, standards, or platforms across multiple domains or business units.
- Experience managing or coordinating governance projects and managed service providers across business and technical teams.
- Strong stakeholder management skills, including the ability to navigate differing incentives across Business, IT, Security, Legal, Privacy, and Compliance functions.
- Strong ability to translate regulatory requirements and governance strategy into practical, executable processes.
Education Required: Bachelor’s Degree or equivalent experience in data management, information governance, records/information management, information systems, or a related discipline.
Preferred Qualifications
- Working knowledge of GDPR, PIPL, and other global privacy and records regulations and their classification and retention requirements.
- Records & information management or information governance certification (e.g., IGP, CRM, ARMA-related).
- Data governance or privacy certifications such as CDMP, DGSP, CIPP, CIPM, DAMA-related, or equivalent experience.
- Experience with data in a regulated environment, particularly GxP, clinical trial data, or R&D data.
- Experience defining and reporting sensitive data, classification, and retention KPIs for leadership audiences.
- Strong facilitation skills, including leading workshops, onboarding sessions, and governance working groups.
Supervisory Responsibilities:
- Supervisory responsibilities are delivery-focused and include leading and providing direction to managed service providers on classification and retention initiatives, while providing strategic oversight and direction to federated data governance resources.
