Director - Healthcare - Data Security and Data Protection

Job description

Director – Healthcare – Data Security and Data Protection

The role will be working in the UK Cyber Security practice within our Technology and Data service line in Advisory. Its primary focus will be helping healthcare clients protect sensitive personal and clinical data, maintain public trust, meet data protection obligations and enable secure data use across digital care, cloud, AI, research and operational services. The role will also support data security and data protection opportunities across the broader public sector where the candidate’s healthcare experience, technical expertise and propositions are relevant. Our specialists provide independent, practical advice and technical capabilities to help clients govern, protect and use data responsibly throughout its lifecycle, while strengthening resilience, regulatory compliance and service outcomes.

We provide cyber security services to clients across three coverage groups:

• Financial Services
• Sectors
• Infrastructure, Government and Health

This is a Director role to lead our go-to-market approach for data security and data protection services, with healthcare as the principal market focus and a broader remit across central and local government, public bodies and other public services. Healthcare clients include NHS organisations, Arm’s Length Bodies, provider organisations, commissioners, regulators and private healthcare organisations. The role will originate and lead engagements spanning privacy, information governance, data security, data risk, secure data sharing and responsible data use; strengthen KPMG’s relationships across healthcare and the wider public sector; and contribute to the leadership of our cyber security business in Infrastructure, Government and Health.

The Director role will be responsible for the following areas:

• Work collaboratively with healthcare cyber leadership, data and privacy specialists, Government and Health colleagues and alliance partners to deliver the business plan, prioritising healthcare while supporting relevant data security and data protection opportunities across the broader public sector.
• Grow our footprint by addressing client needs across data discovery and classification, privacy transformation, information governance, secure cloud and data platforms, AI governance, identity and access, data loss prevention, records management and third-party data risk.
• Build relationships across health advisory, digital transformation, cloud, data, AI, privacy, technology risk and operational improvement to integrate data security and data protection into healthcare transformation programmes.
• Develop and maintain effective working relationships with strategic alliance partners, including Microsoft and ServiceNow, to create differentiated healthcare propositions and deliver data discovery, classification, protection, monitoring, privacy operations and secure data-use solutions.
• Lead and develop a multidisciplinary team with strong healthcare, privacy, information governance, data security and technical delivery capabilities, and support recruitment of specialist resources.
• Originate and lead sales opportunities for data security and data protection, primarily across healthcare organisations and, where relevant, across central government, local government, public bodies and other public services.
• Build senior internal and external relationships and maintain a high-quality pipeline of data security, privacy and information governance opportunities, led by healthcare demand and extended selectively across the wider public sector.
• Lead data security and data protection engagements, ensuring quality, commercial discipline and alignment with healthcare operations, clinical safety, regulatory obligations and patient trust.
• Define and recruit the skills needed to strengthen our healthcare team, including privacy, information governance, data architecture, data security engineering, cloud security, AI governance and regulatory assurance.

Reporting to the Lead Cyber Security Partner for Health, the Director role involves:

• Taking accountability for data security and data protection engagements and leading multiple programmes with support from Senior Managers and Managers.
• Expanding our healthcare services through propositions addressing privacy transformation, information governance, secure data sharing, data lifecycle controls, cloud and AI data protection, and regulatory assurance.
• Provide leadership across coverage groups to deliver a clear, unified strategy for healthcare data security and data protection, while adapting relevant propositions and delivery approaches for the broader public sector.
• Lead healthcare sales origination and business development for data security, privacy and information governance, and help extend proven healthcare propositions into the broader public sector as part of the Technology and Cyber Security leadership team.
• Identifying growth opportunities arising from healthcare data risk, digitisation, interoperability, cloud adoption, AI, research, regulatory change and the need for trusted data use.
• Build and manage senior relationships across healthcare, including CIOs, CCIOs, CNIOs, CISOs, SIROs, Data Protection Officers, Caldicott Guardians, Chief Data Officers, clinical leaders and boards, while developing relevant relationships with digital, data, security and information-governance leaders across the broader public sector.
• Identifying and progressing business development opportunities, including RFP responses, bids, proposals and client presentations focused on data security and data protection.
• Developing internal networks across cyber, digital health, privacy, information governance, data, cloud, AI, risk and public sector teams.
• Coaching team members to build commercially confident, technically credible and sector-aware capability in data security and data protection.
• Contributing to training, knowledge management, thought leadership, propositions and reusable healthcare assets for data security, privacy and information governance.
• Travelling in the UK to regional offices and client sites, including healthcare clients where required; and travelling in the UK or internationally to support client delivery where required.
• Acting in line with KPMG’s values at all times.

The person

• Bachelor’s degree qualification.
• MBA, Master’s degree or relevant professional qualification desirable.
• Substantial experience in healthcare, ideally within the NHS, public sector health, private healthcare, health technology, life sciences or a closely related data-intensive and regulated environment. Experience applying this expertise to central government, local government, public bodies or other public services would be advantageous.
• Senior-level expertise in data security and data protection, with the credibility to advise healthcare leaders on privacy, information governance, data risk, secure data use, data sharing and technical protection controls.
• Strong knowledge of healthcare data flows, operating models and decision-making across NHS organisations, national bodies, providers, commissioners, regulators and private healthcare organisations.
• Established healthcare relationships and market knowledge, with the ability to engage Data Protection Officers, SIROs, Caldicott Guardians, CISOs, Chief Data Officers, clinical leaders and boards.
• Commercial awareness and industry relationships that support significant annual revenue targets through origination, account development and high-quality delivery of data security and data protection services.
• Deep technical knowledge of data security and privacy, including data discovery and classification, data lifecycle controls, encryption, key management, identity and access management, data loss prevention, monitoring, secure data sharing, privacy engineering and cloud data protection. The successful candidate must be technically sound and comfortable shaping, configuring and overseeing the deployment of relevant Microsoft and ServiceNow technologies in support of data-security outcomes.
• Strong knowledge of UK GDPR, the Data Protection Act 2018, common law confidentiality, the Caldicott Principles, NHS information governance expectations, records management, clinical safety and relevant security and privacy standards.
• Proven experience leading and delivering privacy, information governance, data security, data transformation and managed service engagements for large and complex organisations.
• Proven ability to connect data security and data protection risk to healthcare outcomes, patient confidentiality, clinical safety, operational continuity, public trust and board accountability.
• Excellent communication skills, including the ability to explain legal, regulatory, governance and technical data risks to executives, clinicians, operational leaders and boards.
• Extensive sales, negotiation and project leadership experience, with a track record of converting healthcare relationships and data-risk insight into secured work.
• Sound understanding of risk management in a professional services environment.
• A collaborative leadership style, able to bring together privacy, information governance, cyber, data, cloud, AI, legal, clinical safety and operational transformation expertise around client problems.

Healthcare data security and data protection differentiators