Chief Information Security Officer (CISO) (Denver)

Chief Information Security Officer (CISO)

About this position

Overview

Tract Capital adopts a unique approach to digital infrastructure investment. Leveraging experience and strategic insights honed over three decades of creating successful companies in the space, we excel in nurturing and advancing leading‑edge digital infrastructure enterprises. Our team of specialized experts is united by a singular purpose: to support the growth of digital infrastructure. Tract Capital goes beyond simple investment by acting as a strategic partner and catalyst for innovation within the sector, ensuring our engagements generate strong financial results while developing essential digital infrastructure to meet growing demands. We have introduced two digital infrastructure strategies: a horizontal, powered‑land strategy focused on creating master‑planned data center campuses called Tract, and a mega‑campus vertical development strategy called Fleet Data Centers.

Position Overview

The Chief Information Security Officer (CISO) is a senior leadership role responsible for establishing, maturing, and governing the enterprise information security program across Tract Capital Management and each of its individual investment strategies (Tract and Fleet Data Centers). Reporting directly to the CITO, the CISO will own information security governance, compliance, risk management, and controls, ensuring that TCM’s security posture satisfies the demands of institutional investors, hyperscale customers, regulatory bodies, and internal fiduciary obligations.

This hands‑on leadership position requires deep expertise in building information security programs within complex, multi‑entity investment structures. The CISO will work across corporate IT, operational technology (OT) environments, and third‑party ecosystems to deliver a unified governance model that scales with TCM’s rapid growth.

Job Responsibilities

Information Security Governance

• Design and lead TCM’s enterprise‑wide Information Security Management System (ISMS) aligned to ISO/IEC 27001 and NIST 800‑53, covering corporate IT and OT environments across all entities.
• Establish and chair an Information Security Governance Committee with representation from TCM, Tract, and Fleet Data Centers, integrating into the existing risk committee structure chaired by the Chief Legal Officer.
• Own the information security policy framework across all entities, including the Acceptable Use Policy, AI Policy, Access Control Policy, Data Classification & Handling, Incident Response, and supporting Fleet policies (0034–0039).
• Drive the adoption and operationalization of ISO 27001 certification and ISO 42001 (AI Management System) across appropriate entities.
• Present security posture, risk exposure, and program maturity to the ELT Steering Committee (SteerCo), Risk Committees, and the CITO on a regular cadence.
• Serve as the authoritative voice on information security during investor operational due diligence (ODD) processes, responding to DDQs (e.g., Future Fund ORR, SIG questionnaires) and representing TCM’s security posture to institutional investors.

Compliance & Regulatory

• Build and operate the information security compliance program spanning TCM corporation, Tract (land/development), and Fleet Data Centers (critical infrastructure), recognizing the distinct regulatory and contractual obligations of each strategy.
• Maintain and continuously improve alignment with applicable frameworks: ISO 27001, NIST 800‑53, SOC 2 Type II, GDPR, CCPA, and customer‑specific security requirements (hyperscaler contracts, FedRAMP where applicable).
• Own TCM’s compliance posture scoring using Microsoft Purview Compliance Manager and equivalent tools, mapping internal controls to required frameworks.
• Partner with the CLO and outside counsel (Kirkland & Ellis) to ensure information security practices align with securities regulations, fiduciary obligations, fund LPA requirements, and evolving data privacy legislation.
• Manage the relationship with Trace3 Security Solutions and other third‑party assessors for independent penetration testing, vulnerability assessments, and security audits conducted against NIST 800‑115, OWASP, and MITRE ATT&CK methodologies.
• Ensure compliance with EU data protection requirements (GDPR, Schrems II) as TCM expands its European investment footprint through Tract II.

Controls & Risk Management

• Define, implement, and monitor information security controls at both the TCM enterprise level and within each investment strategy, ensuring appropriate segmentation and tailoring of controls to each entity’s risk profile.
• Own the enterprise third‑party / vendor risk management program in coordination with the Technology Requirements Checklist, evaluating all vendors against 50+ controls spanning Authentication & Identity, Security & Compliance Certifications, Data Residency & Protection, Integration & API Security, and Operational Resilience.
• Oversee data loss prevention (DLP), information classification, sensitivity labeling (Microsoft Purview), and data governance controls to protect investor data, financial information, deal pipeline data, proprietary design drawings, and other confidential information.
• Manage the enterprise identity and access management (IAM) governance in partnership with the IT team — including Entra ID Conditional Access policies, RBAC enforcement, SCIM lifecycle automation, and Privileged Identity Management (PIM).
• Lead the Insider Risk Management program using Microsoft 365 security stack capabilities, including behavioral analytics for data exfiltration, IP theft, and policy violations.
• Maintain and exercise the Incident Response Plan and Disaster Recovery / Business Continuity Plans, coordinating with the CITO, CLO, and risk committee chairs for incident classification, escalation, and investor/customer notification per contractual timelines.
• Govern the security awareness training program (KnowBe4), including phishing simulations, the Tract Capital Cyber Security Safety Guide, and new‑hire security onboarding.

Collaboration & Stakeholder Management

• Partner with Fleet’s SVP of Physical, OT, & Cyber Security to align corporate IT security governance with converged physical/OT/cyber security operations at data center facilities.
• Collaborate with the CFO and finance organization on controls relevant to fund accounting, capital call processes, wire transfer security, and investor portal security.
• Support the CITO in AI governance, ensuring Enterprise‑Approved AI Tools (e.g., Glean) operate within security and data governance guardrails and that the AI Policy is enforced.
• Interface with hyperscaler customer security teams to satisfy contractual security requirements and support customer due diligence processes.
• Work with Investor Relations to maintain DDQ‑ready security documentation and ensure timely, accurate responses to ODD questionnaires.

Basic Qualifications

• Bachelor’s degree in Information Security, Computer Science, Engineering, or related field.
• 10+ years of progressive information security experience, with at least 5 years in a CISO, Deputy CISO, or equivalent senior security leadership role.
• Demonstrated experience building and maturing information security programs in private equity, asset management, or financial services environments with multi‑entity / multi‑fund structures.
• Deep working knowledge of ISO 27001, NIST 800‑53, SOC 2 Type II, and demonstrated experience leading organizations through certification and audit processes.
• Expert‑level understanding of data protection regulations (GDPR, CCPA) and their application to investment management firms with cross‑border operations.
• Hands‑on experience with Microsoft 365 security and compliance stack — Entra ID, Defender XDR, Purview (DLP, sensitivity labels, Insider Risk, Compliance Manager), Intune, and Conditional Access.
• Strong background in third‑party risk management and vendor security assessment programs.
• Experience with incident response planning, execution, and post‑incident reporting in environments with investor and regulatory notification obligations.
• Proven ability to communicate security posture and risk to executive leadership, boards, and institutional investors — including experience with investor ODD/DDQ processes.

Preferred Qualifications

• Experience with critical infrastructure security, including OT/ICS environments (data centers, utilities, industrial).
• Familiarity with ISO 42001 (AI Management System) or demonstrated experience establishing AI governance frameworks.
• Experience supporting SEC‑registered or SEC‑exempt investment advisers and understanding of related compliance obligations.
• Knowledge of REIT structures, fund accounting controls, and the security considerations unique to real estate private equity.
• Experience with FedRAMP requirements as they relate to customer contractual obligations.
• Advanced degree (MBA, MS in Cybersecurity, or equivalent).
• Active certifications: CISSP, CISM, CISA, CRISC, or equivalent.

Competency

• Strategic Vision — Ability to translate business strategy and growth trajectory into a scalable security program that enables, rather than constrains, the business.
• Multi‑Entity Governance — Comfort operating across distinct legal entities with different risk profiles, regulatory postures, and operational models under a unified governance umbrella.
• Investor‑Grade Communication ]]>