At EY, we’re all in to shape your future with confidence.
We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.
Position Summary:
The Policy, Controls & Information Lifecycle SME is an Associate Director role within the Global Data Stewardship Office, combining policy, risk, controls and information lifecycle expertise with hands-on technology implementation. The role translates approved obligations into working control logic, machine-readable rules, metadata models, configured workflows and supported integrations in data products, platforms and business processes. It develops reusable patterns for classification, discovery, access, use, sharing, retention, legal hold, archival and defensible disposal, supporting federated stewardship, automation, continuous assurance and responsible data and AI use. Working with business, control and technology stakeholders, the role applies product management practices to understand user needs, define requirements, develop roadmaps and prioritised backlogs, and support design, delivery, testing, approved release, adoption and operational handover. It delivers scoped governance and lifecycle control capabilities within approved architecture, security and delivery parameters, measuring business value, adoption and control effectiveness while respecting the accountability boundaries set out below.
Essential Functions of the Job:
- Establish and maintain a reusable control catalogue and an approach for translating policy into controls, linking approved obligations to implementation requirements, accountable roles, testing and evidence.
- Translate approved obligations and business needs into business, functional and non-functional requirements, including control objectives, decisions, triggers, rules, exceptions, metadata, workflow logic and measurable acceptance criteria.
- Map requirements to data domains, products, assets, classifications, critical data elements, lifecycle stages, jurisdictions and accountable roles.
- Define, configure and validate reusable control patterns and workflows for data creation, classification, discovery, access, use, sharing, retention, legal hold, archival and defensible disposal, including approvals, exceptions, escalation and auditable evidence. Validate retention and disposal logic against approved schedules and hold requirements with accountable owners before deployment.
- Embed governance requirements into data products, cloud platforms, collaboration environments, business processes and uses involving AI.
- Translate approved policy and business requirements into traceable, machine-readable control rules and metadata; configure supported automation for classification, lifecycle decisions, exception handling, evidence collection and continuous control monitoring, while retaining accountable human decisions where required.
- Maintain traceability from approved requirements through design, configuration, integration, testing, exceptions, operational handover and evidence. Execute configuration and integration tests covering hold precedence, retention triggers, access decisions and disposal safeguards; coordinate user acceptance testing and resolve defects. Prepare release, rollback and support documentation for approved deployment, and support user guidance, adoption and handover to designated operational owners.
- Assess control gaps and implementation constraints; recommend proportionate interim controls and remediation roadmaps, documenting residual risk for decision by accountable owners.
- Facilitate workshops with Service Lines, Service Line Quality, legal, risk, data and technology stakeholders to agree control and lifecycle requirements, explain solution options in practical business language, resolve dependencies and assess implementation readiness.
- Conduct discovery with business stakeholders, policy, control, records and data owners and platform users; develop capability roadmaps, prioritised delivery backlogs and user stories. Agree priorities and acceptance criteria with relevant product teams and platform owners, negotiate trade-offs and coordinate dependencies within the role’s remit.
- Evaluate governance, information protection, records, workflow and GRC platform capabilities; deliver proofs of concept and scoped implementations of approved control rules, metadata models and lifecycle workflows, using supported APIs, connectors or scripting-based integrations within authorised environments.
- Agree outcome measures with business and control owners; track business value, adoption and control effectiveness through coverage, lifecycle compliance, exception volumes, evidence completeness and reduced manual effort. Validate discovery and classification outputs with accountable owners and provide trusted metadata for downstream controls and monitoring.
- Coordinate specialist requirements with Global Data Protection, Information Security, Global Records and Information Management and General Counsel’s Office. Work with the wider data ecosystem, including the Global Data Office (GDO), Chief Technology Officers (CTOs), Chief Information Officers (CIOs) and Regional Data Stewards, to align control implementation, delivery dependencies and adoption.
Analytical/Decision Making Responsibilities:
- Exercises the judgement expected of an Associate Director when approved obligations overlap, conflict or cannot be implemented consistently across jurisdictions, processes and technology platforms.
- Clarifies approved policy and risk intent with accountable owners, identifies affected information and processes, evaluates control options and recommends proportionate, scalable implementation patterns.
- Balances global consistency with local legal obligations, business needs, user experience, platform constraints, automation feasibility and evidence requirements.
- Recommends exception conditions, interim controls, monitoring evidence and remediation paths where the target control cannot yet be implemented; refers approval and risk acceptance to designated owners.
- Assesses implementation options, integration dependencies, maintainability and control effectiveness. Selects configuration and automation approaches within approved patterns and delegated authority, delivering the design, configuration, supported integrations, testing and implementation evidence for assigned control capabilities.
- Escalates unresolved priorities, dependencies, conflicting obligations and decisions outside delegated authority to the relevant policy, control, data, Legal, Risk, Investment, Architecture, Information Security or Technology decision-makers.
Knowledge and Skills Requirements:
- Deep expertise in policy-to-control translation and information lifecycle governance, supported by a strong understanding of governance by design, federated stewardship, ownership and decision rights, data domains and products.
- Strong policy, risk and control design capability, including control objectives, preventive and detective controls, rules that can be applied by technology, automated evidence, continuous monitoring and exception management.
- Broad knowledge of metadata, catalogues, glossaries, classification, discovery, lineage, data quality, access, sharing, reuse, retention, archival and defensible disposal.
- Practical understanding of data and AI governance, including provenance, quality, permissions, permitted use, traceability and accountable human oversight.
- Ability to convert approved obligations into technical specifications, user stories, metadata schemas, machine-readable control rules, configured workflows and measurable acceptance criteria, maintaining traceability from source requirements to implementation and control evidence.
- Practical technical knowledge of cloud data and collaboration platforms, workflow and GRC systems, APIs, connectors, event triggers and interoperability; ability to use SQL and an appropriate scripting language, such as Python, to validate metadata, control rules, lifecycle outcomes and supported integrations within authorised environments.
- Hands-on skills in governance and control platform configuration, classification and lifecycle metadata modelling, retention and hold logic, approval and exception workflows, and automated evidence collection; ability to assess capability fit, design supported integrations and connect trusted metadata with access, permitted-use and lifecycle controls.
- Applied product management skills in business and user discovery, roadmap development, backlog prioritisation, agile delivery, dependency and trade-off management, release planning, adoption and value measurement; ability to balance control effectiveness, lifecycle obligations, user needs and implementation effort.
- Working knowledge of version control, environment separation, configuration and integration testing, defect management, approved deployment and rollback, least-privilege access and secure handling of credentials; ability to document solutions and transition scoped capabilities to designated support owners.
- Strong interpretation, systems thinking, structured problem solving and sound judgement across overlapping risk, operational and technology requirements.
- Strong facilitation, concise writing, influencing and negotiation skills across policy, records, privacy, security, business, Service Line Quality, data and technology audiences. Ability to explain technical concepts in practical business language, translate needs into implementable solutions and build agreement on priorities, delivery, adoption and outcomes with stakeholders outside the reporting line.
- Applied knowledge of relevant DAMA-DMBOK disciplines and EDM Council DCAM or CDMC capabilities, particularly governance, accountability, metadata, control evidence and lifecycle management. Familiarity with role-relevant guidance from ISO/IEC 38505, ISO 8000, ISO/IEC 27001, NIST and ISO 15489 is advantageous; expertise in every framework is not required.
Supervision Responsibilities:
- Operates with a high degree of independence within approved policy, risk, governance and delivery parameters, with direction on major priorities and material accountability decisions.
- Has no direct reports and no indirect supervisory accountability.
- Provides specialist functional leadership and may coordinate work delivered through teams from different functions or reporting lines; people management accountability remains with the relevant team leaders.
Other Requirements:
- Works globally across the Global Data Stewardship Office and partners with the Global Data Office, Client Technology, Enterprise Technology, Information Security, Global Data Protection, General Counsel’s Office, relevant Risk and Business Administration teams, Service Lines, Service Line Quality, Regions and EY member firms.
- Engages primarily with Director, Associate Director, Manager and equivalent stakeholders to clarify approved obligations, agree control requirements, resolve lifecycle issues, assess exceptions and support implementation decisions in a global, federated organisation.
- Delivers assigned control requirements, configurations, supported integrations and validation within approved access, architecture, security and change controls. Policy owners retain policy ownership and approval; designated control owners retain control accountability and approvals; authorised Legal and Risk stakeholders retain legal interpretation and risk acceptance. Data Owners and Data Stewards retain their data and permitted-use accountabilities. Product teams and designated Product Owners retain product accountability; platform owners and authorised technology and security teams retain enterprise architecture authority, security approval, infrastructure engineering, production change authority and production operations. The role coordinates specialist input and operational handover without replacing Legal, Privacy, Information Security, Records Management or Internal Audit.\
- Location, employment terms, flexibility and travel requirements are subject to business and local policy requirements.
Job Requirements:
Education:
- Bachelor’s degree or equivalent tertiary qualification in information systems, computer science, software or data engineering, or a related technical discipline, or equivalent substantial professional experience in technology implementation. Relevant data governance, policy, risk, controls and information lifecycle knowledge is essential. Candidates with information management, business, risk or compliance backgrounds are welcome where they demonstrate equivalent technical foundations and practical implementation capability.
Experience:
- Typically 8 or more years of relevant experience in one or more of data governance, controls, privacy, information security, records, compliance, information lifecycle or risk management enabled by technology.
- Demonstrated experience implementing approved policy, regulatory and risk obligations through hands-on configuration of controls and lifecycle workflows, supported integrations, testing, evidence and operational transition in a complex enterprise. Practical delivery experience is essential and should complement requirements definition or advisory expertise.
- Experience translating obligations into control objectives, metadata requirements, workflow logic, rules that can be applied by technology, exceptions and acceptance criteria.
- Practical experience implementing a relevant combination of classification, data loss prevention, data security posture management, identity and access, retention, legal hold, archival, disposition, rules engines, control libraries and continuous monitoring. Experience must include validating approved control behaviour, exceptions and evidence; experience across every capability is not required.
- Hands-on implementation experience with at least one enterprise governance, information protection, records, workflow or GRC platform is essential, including configuring metadata or control models, approval and exception workflows, classification or lifecycle rules, and implementing and validating supported integrations with cloud or collaboration platforms, APIs or automation tools.
- Demonstrated experience applying product management practices to governance and lifecycle control delivery: discovering business and user needs, defining business, functional and non-functional requirements, maintaining roadmaps and prioritised backlogs, agreeing measurable acceptance criteria and managing dependencies and trade-offs through design, implementation, testing, approved release, adoption and operational handover.
- Evidence of measurable improvements from technology-enabled governance and controls, such as increased classification or retention coverage, reduced manual approvals, more complete control evidence, faster exception resolution or verified lifecycle outcomes.
- Experience influencing stakeholders outside the reporting line in a global, federated organisation, including business, Service Lines, Service Line Quality, data, legal, policy, records, privacy, security, architecture, product and engineering functions. Evidence of facilitating decisions, negotiating priorities, resolving dependencies and building agreement on delivery, adoption and outcomes.
- Practical implementation experience with Microsoft Purview, Microsoft Information Protection or Microsoft 365 retention capabilities is advantageous. Comparable experience with AvePoint, DLP or DSPM technologies, workflow or GRC platforms and policy services native to cloud platforms is also valued. Relevant experience should demonstrate translating approved obligations into configured classification, access, retention, hold, disposition or evidence workflows and supported integrations. Experience with every named platform is not required.
Certification Requirements:
- Relevant credentials such as DAMA CDMP, IAPP, ISACA, information security, records management, product management, cloud or governance and control platform certifications are advantageous but not mandatory.
What we offer you The compensation ranges below are provided in order to comply with United States pay transparency laws. Other geographies will follow their local salary guidelines, which may not be a direct conversion of published US salary ranges. At EY, we harness our collective strength to empower you to shape your future with confidence through professional growth, personal fulfillment and an inclusive culture. Learn more at ey.com/us/careers.
- We offer a comprehensive compensation and benefits package where you’ll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job is:
- New York City, Boston, and Washington DC Metro Areas, Washington State, and Southern California offices – $180,000 to $324,000
- Bay Area California offices – $187,500 to $337,500
- All other offices locations in the US, including Sacramento – $150,000 to $297,000
- Individual salaries within these ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
- Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.
Are you ready to shape your future with confidence? Apply today.
- To make the most of your application experience, please limit yourself to two applications within a six-month period.
- EY accepts applications for this position on an on-going basis.
- For those living in California, please click here for additional information.
- At EY, our values set the foundation for how we work and the behaviors we expect of our people. Any misrepresentation or falsification of information or lack of integrity at any point in the recruiting process may result in withdrawal of your candidacy, revocation of an offer or immediate termination of employment.
EY | Building a better working world
EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.
Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.
EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.
All in to shape the future with confidence.
EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law.
EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY’s Talent Shared Services Team (TSS) or email the TSS at ssc.customersupport@ey.com.
