Vice President, Cybersecurity and Deputy Chief Information Security Officer

The mission of The New York Times is to seek the truth and help people understand the world. That means independent journalism is at the heart of all we do as a company. It’s why we have a world-renowned newsroom that sends journalists to report on the ground from nearly 160 countries. It’s why we focus deeply on how our readers will experience our journalism, from print to audio to a world-class digital and app destination. And it’s why our business strategy centers on making journalism so good that it’s worth paying for. About the Role:As Vice President, Cybersecurity and Deputy CISO, you will translate our cybersecurity strategy into operational reality.You will:Lead and integrate core security functions, including security architecture and engineering, threat detection and incident response, security operations, identity and access management, and risk and compliance.Own day-to-day cybersecurity program execution, including annual planning, roadmap delivery, operational reviews and metrics.Serve as the primary operational escalation point for significant security risks and incidents, partnering closely with Global Security, Legal, Communications, Enterprise Technology and business leaders.Act as a visible security leader with executives, senior editors and technology leaders, helping them understand risk, tradeoffs and priorities in practical terms.Serve as acting CISO when needed, including during executive forums, audits and key stakeholder meetings.This is a hybrid role based in our New York City headquarters, reporting to the CISO and Head of Enterprise Technology. You can typically expect to come into the office 3+ days per week.Responsibilities:Program leadership and strategy executionOwn the day-to-day execution of the cybersecurity strategy and roadmap, ensuring alignment with company and Technology prioritiesTranslate high-level risk and board-level objectives into concrete programs, projects and measurable outcomesStrategically manage the Cybersecurity budget, including coordinating with finance, setting multi-year forecasts, and managing billing workflows for Cybersecurity vendorsEstablish and run operating rhythms for Cybersecurity, including staff meetings, portfolio reviews, operational reviews, OKRs and metricsPartner with the CISO on multi-year planning, budget development and investment prioritization across tools, people and servicesDrive continuous improvement using internal metrics, external benchmarks and findings from assessments, incidents and exercisesSecurity architecture, engineering and operationsProvide senior leadership across security engineering, architecture and operations, ensuring our security stack is robust, observable and well-integrated with Enterprise Technology and Developer PlatformsGuide the evolution of core controls such as endpoint protection, EDR, SIEM, email security, web security, vulnerability management, secrets management, MDM and identity governancePartner with Enterprise Technology, Developer Platforms and product engineering to embed secure-by-design patterns, guardrails and self-service controls into platforms and workflowsProvide oversight and strategic direction for identity and access management, including identity platforms, access orchestration and privileged accessEnsure operational excellence for security tooling, including lifecycle management, vendor relationships and integration with incident response and monitoring workflowsDetection, incident response and resilienceOversee threat detection, monitoring and incident response programs, including a modern, automation-forward SOC capability.Serve as senior escalation leader for high-severity incidents, driving real-time decision-making, cross-functional coordination and executive communicationsEnsure playbooks, tabletop exercises, red/purple team activities and crisis management plans are in place, tested and regularly updated.Partner with Global Security, Business Continuity and Enterprise Technology on integrated resilience programs, including disaster recovery, crisis response and resilience exercisesEnsure post-incident reviews lead to durable improvements in controls, processes and architectureGovernance, risk, compliance and security educationLead cybersecurity governance and risk management frameworks in alignment with NIST CSF 2.0 and other relevant standardsDrive the development and use of risk metrics, control health indicators and dashboards to communicate security posture to executives, Audit Committee and other stakeholdersStrategically support security education programs to ensure a metrics-driven approach to providing relevant training and resources to our staffNewsroom and high-risk user securityPartner with newsroom teams to support the unique threat models of journalists and other high-risk users.Ensure security measures and controls enable, rather than impede, high-stakes newsgathering, international reporting and sensitive investigative workSupport programs that protect journalists and high-risk staff across travel, field operations, online harassment and digital threatsPeople leadership and cultureLead, mentor and develop senior managers and staff across multiple security disciplines, building a high-performing, inclusive and collaborative teamFoster a growth-minded, metrics-driven, blameless culture focused on learning and continuous improvementSupport career paths, succession planning and leadership development across Cybersecurity, including preparing future CISO-level leadersHelp champion security awareness and education programs that engage staff at all levels in shared security ownershipEngage in cross-industry collaboration and knowledge sharing to ensure that The New York Times is up-to-date on latest security events, techniques, and industry normsDemonstrate support and understanding of our value of journalistic independence and a strong commitment to our mission to seek the truth and help people understand the worldBasic Qualifications:12+ years of progressive experience in cybersecurity or information security, including leadership of large, complex security programsExperience leading multiple security domains, such as security engineering, security operations, incident response, cloud security, identity, application security or GRCPrior experience in a VP, Head of Security, Deputy CISO or similar senior leadership role with accountability for both strategy and executionDeep technical understanding of modern security architectures, including cloud (AWS, GCP or similar), network, endpoint, identity and application securityProven track record leading major incident response efforts and security crisis management, including communication with executives and external stakeholdersStrong familiarity with industry frameworks and standards such as NIST CSF, ISO 27001, SOC 2, PCI, HIPAA and data protection regulationsExperience working in close partnership with teams across Legal, Privacy, HR, Finance, Internal Audit and external regulators or auditorsExpertise building and leading diverse teams, including developing senior managers and cross-functional leadersPreferred Qualifications:Experience securing media, news, technology or similarly fast-paced, high-profile environments with unique threat modelsBackground working directly with or supporting newsroom, high-risk user or investigative teamsExperience presenting to boards or audit committees and supporting public-company security and risk disclosuresExperience operating in a global context, including international offices, complex regulatory environments and cross-border data considerationsPrior experience shaping AI governance, AI security or emerging-technology security programs#LI-HybridREQ-020259The annual base pay range for this role is between:$275,000—$290,000 USDAdditional Compensation and BenefitsFor roles in the U.S., dependent on your role, you may be eligible for variable pay, such as an annual bonus and restricted stock. Benefits may include medical, dental and vision benefits, Flexible Spending Accounts (F.S.A.s), a company-matching 401(k) plan, paid vacation, paid sick days, paid parental leave, tuition reimbursement and professional development programs. For roles outside of the U.S., information on benefits will be provided during the interview process.Candidate Use of GenAI ToolsWe’re excited to learn more about you and your experience. To keep our hiring process as fair and authentic as possible, we ask that you submit your own work and not use GenAI tools to generate substantive content during the application and interview process.If you’re an Engineering candidate, we’ll let you know what specific GenAI tools you are permitted to use for your technical assessment.The New York Times Company is committed to being the world’s best source of independent, reliable and quality journalism. To do so, we embrace a diverse workforce that has a broad range of backgrounds and experiences across our ranks, at all levels of the organization. We encourage people from all backgrounds to apply.We are an Equal Opportunity Employer and do not discriminate on the basis of an individual's sex, age, race, color, creed, national origin, alienage, religion, marital status, pregnancy, sexual orientation or affectional preference, gender identity and expression, disability, genetic trait or predisposition, carrier status, citizenship, veteran or military status and other personal characteristics protected by law. All applications will receive consideration for employment without regard to legally protected characteristics. The U.S. Equal Employment Opportunity Commission (EEOC)’s Know Your Rights Poster is available here. The New York Times Company will provide reasonable accommodations as required by applicable federal, state, and/or local laws. Individuals seeking an accommodation for the application or interview process should email View email address on click.appcast.io. Emails sent for unrelated issues, such as following up on an application, will not receive a response.The Company encourages those with criminal histories to apply, and will consider their applications in a manner consistent with applicable "Fair Chance" laws, including but not limited to the NYC Fair Chance Act, the Los Angeles Fair Chance Initiative for Hiring Ordinance, the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act.For information about The New York Times' privacy practices for job applicants click here.Please beware of fraudulent job postings. Scammers may post fraudulent job opportunities, and they may even make fraudulent employment offers. This is done by bad actors to collect personal information and money from victims. All legitimate job opportunities from The New York Times will be accessible through The New York Times careers site. The New York Times will not ask job applicants for financial information or for payment, and will not refer you to a third party to do so. You should never send money to anyone who suggests they can provide employment with The New York Times.If you see a fake or fraudulent job posting, or if you suspect you have received a fraudulent offer, you can report it to The New York Times at View email address on click.appcast.io. You can also file a report with the Federal Trade Commission or your state attorney general.