VICE PRESIDENT OF INFORMATION TECHNOLOGY & SECURITY

Job Description

Job Description:\n\nDescription: JOB OVERVIEW The Vice President of Information Technology & Security provides strategic and operational leadership over BS&A Software’s internal technology and security functions. Reporting to the Chief Technology Officer (CTO), this role holds end-to-end accountability for IT infrastructure, business applications, enterprise security, internal support services, vendor management, and enterprise security governance, risk, and compliance (GRC). The role also provides oversight of the Project Management Office (PMO), ensuring technology initiatives are prioritized, coordinated, and aligned with business objectives. The role also owns the data foundation, infrastructure, and security standards that BS&A's enterprise AI initiatives depend on, working in close partnership with the VP of AI Transformation, who owns the company's AI vision, roadmap, and governance. The VP serves as BS&A’s senior operational leader for IT and security strategy and operations, working in close alignment with the CTO to enable secure organizational growth, technology modernization, and operational resilience. This position blends high-level planning with hands-on technical execution, leading a hybrid team of internal professionals and external MSP/MSSP partners to deliver a scalable, secure, and supportable enterprise environment. Requirements: KEY RESPONSIBILITIES Technology Strategy & Organizational LeadershipDevelop and execute an integrated technology and security roadmap aligned with BS&A’s growth strategy, and operational objectives.Lead a unified organization that includes Infrastructure, End-User Support, Security, Business Applications, IT Governance and PMO.Champion a culture of service excellence, security accountability, and operational scalability across the IT and security domains. Oversee workforce planning and talent development, including role design, career progression frameworks, mentorship, and skills developmentEnsure alignment between IT resources and evolving business priorities through structured intake, prioritization, and planning.Foster cross-functional collaboration and executive alignment to ensure technology strategy enables and accelerates business goals.Lead IT and security activities across all phases of mergers and acquisitions, including pre-acquisition due diligence, integration planning, and post-acquisition execution. Ensure secure and scalable integration of infrastructure, applications, identity platforms, and support models while managing risk and minimizing disruption.Own the full IT and Security budget, operating and capital, including planning, forecasting, and in-year management of all spend across the IT and Security functions. Enterprise Applications & Project GovernanceOwn the Enterprise Applications function and team, including the PMO, driving application governance, modernization, migration initiatives, lifecycle planning, vendor management, and technology roadmaps to support business growth and operational excellence.Lead the Project Management Office (PMO), with responsibility for project intake, prioritization, resource coordination, and delivery oversight in alignment with business objectives.Provide architectural oversight and vendor coordination for system integrations, upgrades, and lifecycle planning.Define and maintain application governance frameworks, including access controls, change management policies, and business continuity standards.Establish and enforce a system ownership model across business applications, ensuring alignment between IT, business stakeholders, and external vendors for functionality, support, and data integrity.Govern software license compliance and lifecycle across internal SaaS platforms and desktop applications, including procurement governance, renewals, usage monitoring, and cost optimization.Promote project and portfolio transparency through reporting, stakeholder engagement, and delivery metrics that support prioritization and executive visibility.Oversee internal IT change and release management processes—including coordination with development teams—to ensure secure, compliant, and minimally disruptive deployment of infrastructure, application, and configuration changes across environments.Serve as the data, infrastructure, and security enabler to BS&A's AI Center of Excellence, ensuring the systems and access that internal AI initiatives run on are secure, governed, and dependable. IT Operations & Infrastructure ManagementOwn end-to-end responsibility for all IT infrastructure—on-premise and cloud—including servers, networking, endpoint management, databases, and communication systems. Oversight of BS&A’s SaaS infrastructure is exercised in partnership with Engineering and DevOps, ensuring alignment on security, access, change management, and compliance priorities.Oversee a modern, scalable approach to endpoint management, user provisioning, and virtual desktop infrastructure based on cloud-first and identity-driven principles.Oversee the operational lifecycle, performance, and cost efficiency of core infrastructure services—including networks, storage, compute, and cloud platforms—while maintaining documentation of system architecture, directory services, and access control configurations.Lead a formal change control process aligned with ITIL principles to manage infrastructure changes, patch management, access configurations and operational risk.Maintain accurate configuration records and enforce version-controlled documentation and approval workflows for all changes.Lead the lifecycle management of all IT assets (e.g., laptops, servers, mobile devices, network equipment), ensuring accurate inventory, secure provisioning/decommissioning, and alignment with the annual budgeting, procurement, and refresh cycles.Monitor infrastructure KPIs, vendor SLAs, and capacity plans to support availability, performance, and long-term scalability.Monitor and optimize cloud infrastructure spend through cost governance practices, utilization analysis, and collaboration with finance teams to align resource usage with budget targets.Own the strategy for where BS&A's corporate and internal data lives, how it's structured, and how it's made discoverable, governed, and consumable by AI systems and agents, ensuring the underlying data foundation is AI-ready.Partner with the VP of AI Transformation to enable enterprise AI initiatives, providing the secure data access, integration points, and infrastructure that internal AI agents and tooling depend on, including responsibility for data and infrastructure readiness in the production-readiness review of AI solutions. Security, Governance, Risk and Compliance (GRC)Lead BS&A’s enterprise security program and architecture, overseeing internal security staff and co-managed MSSP partners to ensure comprehensive threat defense and incident readiness.Drive the implementation of Zero Trust principles, identity governance frameworks, role-based access controls, and modern endpoint protection strategies.Oversee technical security operations including firewall standards, configurations, threat detection systems, inter-network segmentation, anti-spoofing protections, and key and certificate management.Lead incident response and threat mitigation activities, including vulnerability assessments, penetration testing, structured remediation, regular posture reviews and post-incident analysis to proactively reduce exposure, improve resiliency and defend against evolving threats.Ensure ongoing alignment with SOC 1 Type 2, SOC 2 Type 2, PCI-DSS, and other regulatory frameworks through technical control framework implementation, policy alignment and continuous evidence collection for both internal and external audits, including ownership of the payments environment and the controls that keep it compliant.Define and own the security and data standards that enterprise AI systems and agents operate within, serving as a key consulted partner to the VP of AI Transformation on enterprise AI governance and guardrails.Own the company’s data privacy program, including privacy policy and posture, in partnership with Legal.Continuously assess and evolve the Security program through maturity models, performance metrics, and stakeholder reporting, ensuring alignment with evolving threats, emerging compliance obligations, and organizational growth.Lead company-wide security awareness efforts, including role-based training programs, simulated phishing campaigns, and education initiatives that reinforce a strong internal security culture.Maintain and continuously improve Disaster Recovery (DR) and Business Continuity Plans (BCP), ensuring readiness through regular testing and alignment with business risk tolerance.Collaborate with Facilities to ensure physical and environmental security of on-premise infrastructure, including office building access controls, server room safeguards, and environmental protections aligned with PCI requirements.Own and maintain the lifecycle of IT and security policies, including version control, stakeholder alignment, and documentation management. Ensure execution of access reviews, role matrices, and evidence collection workflows that support audit readiness and regulatory compliance.Lead IT-related audit readiness efforts and coordinate regulatory interface in collaboration with Legal, Finance, and other departments. This includes quarterly compliance reporting, internal control mapping, and supporting external audit activities.Maintain a centralized IT risk register and control matrix to support continuous control monitoring, risk identification, and maturity tracking.Maintain audit-ready documentation of security configurations, infrastructure diagrams, and control effectiveness.Maintain alignment between change management documentation and compliance control requirements, ensuring traceability and approval workflows are enforced.Monitor and evolve the security program using maturity models, program KPIs, and stakeholder reporting to ensure sustained alignment with organizational growth and threat evolution. Service Delivery, End-User Support & Workplace TechnologyOversee a structured End-User Support function focused on delivering exceptional internal service, timely issue resolution, and continuous improvement in employee technology experience.Define team roles, escalation protocols, and ownership across support tiers, ensuring clarity of responsibilities and alignment with SLAs and service expectations.Establish and track performance metrics (e.g., response times, resolution rates, satisfaction scores) to drive operational accountability and identify areas for improvement.Uphold strict separation between internal IT support and external customer support, ensuring that client-facing requests are routed through designated BS&A support channels.Uphold service level agreements (SLAs), satisfaction tracking, and documentation standards that drive accountability and responsiveness within the support organization.Promote self-service enablement through the development and maintenance of internal knowledge bases, documentation hubs, and automation pathways for common support requests.Lead the execution and continuous improvement of employee onboarding and offboarding processes, ensuring timely provisioning, account setup, and deprovisioning aligned with security and compliance standards.Collaborate with infrastructure and security teams to support endpoint compliance, including MDM enrollment, patching standards, encryption standards, and secure baseline configurations.Continuously evaluate tools, workflows, and delivery models to enhance the scalability, quality, and consistency of internal IT support services.Drive modernization of the digital workplace by introducing and optimizing collaboration platforms, productivity tools, and device strategies that support hybrid work, streamline communication, and enhance employee experience. Vendor & Partner OversightServe as the executive point of contact for MSP, MSSP, and other critical IT and security partners, overseeing onboarding, scope definition, performance management, and alignment with BS&A’s internal capabilities and service expectations.Manage co-managed service models through consistent review, contract management, SLA monitoring, performance reviews and identification of capability or coverage gaps.Collaborate with Legal and Security teams to evaluate third-party risk, ensure data processing agreements are in place, and maintain vendor compliance documentation for audit readiness.Maintain external compliance alignment and escalation pathways across all partner relationships ensuring escalation paths, regulatory expectations, and control obligations are clearly documented and managed.Oversee contract lifecycle and renewal planning, including vendor evaluation, consolidation opportunities, and optimization of cost, value, and risk exposure across the IT and security vendor ecosystem. QUALIFICATIONSBachelor’s or Master’s degree in Information Technology, Computer Science, Cybersecurity, or a related field.Minimum 10 years in IT and security leadership roles, including experience across infrastructure, support operations, governance and enterprise security.Proven ability to lead cross-functional IT and security teams, develop talent, and implement structured role-based career development frameworks.Demonstrated experience overseeing third-party MSP/MSSP partnerships, vendor transitions and co-managed service delivery models.Deep knowledge of enterprise IT platforms, cloud infrastructure, identity governance, endpoint management, and service delivery.Expertise in regulatory and compliance frameworks including SOC 1 Type 2, SOC 2 Type 2, PCI-DSS, and alignment with internal controls and policy frameworks.Demonstrated ability to develop and execute multi-year technology and security roadmaps, aligned with business objectives and operational maturity.Experience operating in regulated or audit-sensitive environments, maintaining structured control libraries and audit-readiness.Required experience operating IT and Security within a SaaS or cloud-native business.Experience owning the Salesforce platform and the broader ecosystem built on it, spanning Sales, CRM, PSA, and ERP/financials.Demonstrated experience owning and managing enterprise business applications built on a platform such as Salesforce, spanning CRM, PSA, and financial/ERP capabilities, including implementations, migrations, integrations, and ongoing application support.Experience leading IT and Security through mergers, acquisitions, and integrations.Strong familiarity with modern security technologies and tools, including endpoint detection and response (EDR), security information and event management (SIEM), intrusion detection/prevention (IDS/IPS), vulnerability management platforms, secure network architectures and firewall technologies.Deep understanding of evolving thr