Director, Information Security

Description

Company Description

Job Description

Core Responsibilities

Business Development, Leadership, Strategic Planning

• Partner with the CISO to operationalize the enterprise information security strategy, translating strategic priorities into executable roadmaps, governance programs, and measurable risk reduction outcomes.
• Build, lead, and develop a global security organization, including GRC teams, SOC/MSSP partners, and cross-functional stakeholders, ensuring accountability, service quality, and follow-the-sun support.
• Partner with HR, Legal, Privacy, business leadership, and IT teams to strengthen governance, accountability, and enterprise-wide ownership of security and compliance initiatives.
• Establish security KPIs, risk metrics, and control maturity roadmaps that provide executive leadership with clear visibility into security posture, performance, and continuous improvement opportunities.
• Conduct enterprise risk assessments, vendor reviews, and control gap analyses while maintaining cybersecurity risk registers and presenting key risk insights to leadership.
• Lead third-party security risk management programs, including vendor due diligence, security assessments, contractual requirements, and ongoing monitoring activities.
• Own and manage the security project portfolio, coordinating internal teams, MSSP partners, and external vendors to deliver strategic security initiatives and business objectives.
• Support the secure adoption of emerging technologies, including AI, automation, and cloud collaboration platforms, by embedding security-by-design principles into business and technology initiatives.

Operations

• Manage the SOC 2 compliance program from control design and implementation through evidence collection, continuous monitoring, audit readiness, certification, and ongoing attestation.
• Lead enterprise HIPAA compliance efforts, ensuring administrative, physical, and technical safeguards meet Security and Privacy Rule requirements for protecting PHI.
• Oversee GDPR compliance in partnership with Legal and Privacy teams, including data protection principles, records of processing activities, data subject rights, cross-border data transfer controls, and breach notification readiness.
• Develop, implement, and maintain security policies, standards, and procedures aligned with regulatory requirements and industry frameworks, including SOC 2, HIPAA, GDPR, ISO 27001, and NIST.
• Manage the security posture and secure configuration of enterprise SaaS and cloud platforms, including Microsoft 365 E5, Azure, Salesforce, Egnyte, Box, Workday, and related technologies.
• Strengthen enterprise identity and access management through Microsoft Entra ID, SSO, MFA, Conditional Access, access reviews, and least-privilege controls.
• Advance secure end-user computing through endpoint protection, remote-work security controls, phishing resistance initiatives, and security awareness programs that minimize business disruption.
• Own enterprise security incident response, including investigation, containment, remediation, recovery, and regulatory reporting, while coordinating with SOC, MSSP, and IT operations teams to maintain 24×7 readiness.

Qualifications & Competencies

• Bachelor's degree and 12 years of related experience or a Master's degree and 8 years of related experience, and at least 5 years in management capacity.
• Hands-on experience owning SOC 2 audits and compliance-evidence programs to successful attestation.
• Strong working knowledge of the HIPAA Security and Privacy Rules and safeguards.
• Demonstrated experience implementing and operating GDPR data-protection controls.
• Experience securing SaaS platforms such as Microsoft 365, Azure, Salesforce, Box, Egnyte, and Workday.
• Strong expertise in IAM, MFA, Conditional Access, and Zero Trust principles.
• Experience managing onshore and offshore security teams and outsourced SOC/MSSP partnerships.

Knowledge & Skills

• Must have at least one Certifications such as CISSP, CISM OR CRISC
• Experience in regulated industries (healthcare, engineering, professional services).
• Familiarity with Microsoft Defender, Purview, CASB, and cloud security posture management (CSPM) tools.
• Experience supporting CMMC or other government/defense compliance frameworks.
• Experienced in leading SOC 2, HIPAA, and GDPR programs, audits, and ongoing compliance activities.
• Skilled in designing and managing security for SaaS-first and cloud-native environments.
• Proven ability to secure enterprise SSO, identity platforms, and access-control frameworks.
• Applies practical judgment to prioritize cybersecurity risks and drive effective mitigation.
• Hands-on experience managing security incidents, escalations, and operational response activities.
• Clearly communicates with technical teams, business users, leaders while translating security risk into business impact.
• Builds strong partnerships with IT, Legal, HR, Privacy, and business leaders to advance shared security objectives.
• Leads onshore and offshore teams with clear direction, accountability, and cross-cultural awareness.
• Balances strong user protection with productivity, usability, and a seamless technology experience.