Director of Cybersecurity, Risk & Compliance

Job Description

Job Description

Director of Cybersecurity, Risk & Compliance

Location: Remote
Department: Technology
Reports To: Chief Technology Officer
FLSA Status: Exempt

About the Opportunity

We are seeking an experienced Director of Cybersecurity, Risk & Compliance to lead cybersecurity governance, cloud security compliance, and information security assurance initiatives within a dynamic, technology-driven organization.

This leadership role is responsible for establishing, implementing, and continuously improving cybersecurity compliance programs across cloud infrastructure, data protection, regulatory compliance, third-party risk management, and organizational resilience.

The ideal candidate brings extensive experience in cybersecurity governance, SOC 2 audit readiness, AWS cloud security, HIPAA compliance, and enterprise risk management. This individual will collaborate closely with Engineering, DevOps, Infrastructure, Legal, executive leadership, and external auditors to ensure security requirements are translated into effective technical controls and operational practices.

This position requires a hands-on leader who can balance strategic compliance initiatives with day-to-day execution, drive cross-functional accountability, and maintain organizational audit readiness.

Key Responsibilities

Cybersecurity Governance & SOC 2 Compliance

• Lead end-to-end SOC 2 Type I and Type II readiness, audit preparation, and execution.
• Oversee technical security control implementation, documentation, and evidence collection.
• Coordinate external auditors, internal control owners, audit walkthroughs, and remediation activities.
• Maintain compliance documentation, evidence repositories, audit calendars, and control tracking systems.
• Establish and maintain continuous compliance monitoring programs.
• Identify, track, and facilitate remediation of security control gaps, audit findings, and compliance exceptions.
• Communicate material cybersecurity risks and compliance concerns to executive leadership.

Cloud Security Governance (AWS)

• Establish and oversee AWS cloud security governance standards and compliance controls.
• Provide oversight of identity and access management (IAM), encryption, logging, monitoring, and privileged access controls.
• Ensure least-privilege access principles and sensitive data protection standards are consistently implemented.
• Validate security controls and appropriate separation between production and non-production environments.
• Maintain cloud security documentation aligned with SOC 2, HIPAA, internal policies, and industry best practices.
• Partner with Engineering, DevOps, and Infrastructure teams to identify security vulnerabilities and coordinate remediation.

Regulatory Compliance & Data Protection

• Lead the implementation and ongoing management of HIPAA technical safeguards and applicable regulatory security requirements.
• Ensure sensitive information, including protected health information (PHI), is appropriately secured.
• Oversee secure data exchange practices involving APIs, SFTP, file transfers, and other data integration technologies.
• Maintain security documentation related to encryption, access controls, logging, monitoring, and data handling.
• Collaborate with technical and business stakeholders to incorporate regulatory and contractual security requirements into organizational policies and procedures.
• Support security assessments, compliance reviews, and regulatory audit activities.

Business Continuity & Disaster Recovery

• Lead Business Impact Analysis (BIA) initiatives across organizational functions.
• Develop, maintain, and continuously improve Business Continuity Plans (BCP).
• Coordinate Disaster Recovery (DR) governance, testing, and documentation.
• Establish and validate recovery objectives, resilience controls, and operational continuity requirements.
• Identify and track remediation of business continuity and disaster recovery gaps.
• Maintain documentation and testing evidence to support compliance and organizational resilience.

Security Awareness & Policy Management

• Develop and manage enterprise-wide cybersecurity awareness and training programs.
• Coordinate phishing simulation campaigns and ongoing employee security education.
• Lead the development, implementation, and maintenance of information security policies and standards.
• Oversee policies related to Generative AI, Data Classification, Third-Party Risk Management, and other cybersecurity governance areas.
• Partner with executive leadership, Legal, and operational teams to coordinate policy reviews and approvals.
• Monitor training participation, policy acknowledgments, and security awareness metrics.
• Promote a strong organizational culture of cybersecurity awareness and accountability.

Third-Party Risk Management

• Lead technical security assessments of vendors, service providers, and third-party technology partners.
• Evaluate SOC reports, penetration testing results, security questionnaires, business associate agreements (BAAs), and related security documentation.
• Maintain vendor risk assessments, risk ratings, remediation plans, and periodic review schedules.
• Collaborate with Legal, Technology, and business stakeholders to ensure third-party security requirements are appropriately addressed.
• Identify and escalate material vendor security risks.
• Support vendor risk acceptance documentation, compensating controls, and ongoing risk monitoring.

DevOps & Technical Security Oversight

• Evaluate DevOps security practices, privileged access controls, and development environment security.
• Oversee security controls for distributed and offshore technical teams, where applicable.
• Ensure production systems and sensitive information are accessed only through authorized and controlled processes.
• Validate data masking, logging, monitoring, and environment segregation standards.
• Coordinate remediation of technical security gaps with Engineering and DevOps teams.
• Maintain documentation supporting technical control effectiveness and compliance requirements.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems, or a related field, or equivalent practical experience.
• Minimum of 8 years of progressive experience in cybersecurity, cloud security governance, risk management, regulatory compliance, audit readiness, vendor risk management, or information security operations.
• Minimum of 3 years of experience leading cybersecurity compliance programs within healthcare or another highly regulated industry.
• Demonstrated experience leading SOC 2 Type I and Type II readiness, audit coordination, technical control implementation, and continuous compliance monitoring.
• Experience developing and managing Business Continuity Plans, Disaster Recovery programs, Business Impact Analyses, and security awareness initiatives.
• Strong knowledge of AWS cloud security architecture and governance, including:
• • AWS Identity and Access Management (IAM)
  • Okta and identity management solutions
  • Single Sign-On (SSO) and Multi-Factor Authentication (MFA)
  • Privileged access management
  • Encryption, logging, and monitoring
  • Environment segmentation and least-privilege access controls
• Strong understanding of HIPAA technical safeguards, PHI protection, data governance, and secure data exchange technologies, including APIs and SFTP.
• Knowledge of cybersecurity frameworks and security assurance practices, including SOC 2, NIST Cybersecurity Framework, CIS Controls, and AWS security standards.
• Experience conducting vendor security assessments and reviewing SOC reports, penetration testing results, security questionnaires, and related compliance documentation.
• Excellent cross-functional leadership, communication, organizational, and stakeholder management skills.
• Ability to translate complex cybersecurity and regulatory requirements into actionable technical and operational controls.
• Experience managing audit documentation, remediation tracking, compliance reporting, and control owner accountability.
• Proficiency with enterprise collaboration, documentation, and reporting tools such as Google Workspace, Salesforce, Smartsheet, or comparable platforms.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Security, Business Administration, or a related field.
• Experience working in healthcare technology, SaaS, cloud-native platforms, or digital health environments.
• Experience supporting healthcare regulatory compliance programs and industry-specific security requirements.
• Familiarity with ISO 27001, AWS Well-Architected Framework, SOC 2 Trust Services Criteria, and HIPAA Security Rule requirements.
• Experience with Governance, Risk, and Compliance (GRC) platforms, ticketing systems, audit evidence management tools, and security awareness solutions.
• Professional certifications such as:
• • Certified Information Systems Security Professional (CISSP)
  • Certified Information Systems Auditor (CISA)
  • Certified in Risk and Information Systems Control (CRISC)
  • CompTIA Security+
  • Certified Cloud Security Knowledge (CCSK)
  • AWS Certified Security – Specialty
  • AWS Certified Cloud Practitioner
  • HealthCare Information Security and Privacy Practitioner (HCISPP)

Professional certifications are preferred but not required.

What We're Looking For

The successful candidate will be a proactive cybersecurity leader who combines deep technical expertise with strong governance, risk management, and organizational leadership capabilities.

We are looking for someone who:

• Takes ownership of complex cybersecurity compliance initiatives and drives them through completion.
• Can work effectively with technical teams, business stakeholders, external auditors, and executive leadership.
• Has a strong understanding of both technical security controls and regulatory compliance obligations.
• Is comfortable operating in a fast-paced, evolving technology environment.
• Demonstrates sound judgment, attention to detail, and strong problem-solving abilities.
• Can identify risks, recommend practical solutions, and establish sustainable security processes.
• Brings a collaborative, hands-on approach to building and maintaining a strong security and compliance program.

Work Environment

• Remote work environment requiring reliable internet connectivity.
• Regular collaboration through virtual meetings and enterprise communication platforms.
• Occasional travel may be required based on business needs.
• Periodic flexibility in work hours may be necessary to support audits, security initiatives, or operational requirements.

Position Overview

This is an opportunity for an experienced cybersecurity professional to play a critical leadership role in strengthening enterprise security governance, advancing regulatory compliance, and supporting the continued growth of a technology-driven organization.

The Director of Cybersecurity, Risk & Compliance will help build scalable, sustainable security practices while working collaboratively with technical teams and executive leadership to protect critical systems, sensitive information, and business operations.

Founded in 2014, Sollucio Partners is a community-driven organization dedicated to solving challenges, fostering innovation, and supporting the communities we serve. Our mission is to create transformative services and products that enhance lives, improve businesses, and advance humanity.

4 Divisions (Advisory, Infotech, Recruiting, Ventures).

1.)Advisory
Provides strategic consulting to help organizations achieve goals, adapt to change, and align IT with business strategies: Fractional CIO Services: On-demand IT leadership. Assessments: Evaluations to identify improvement opportunities. Organizational Change Management: Guiding transitions while minimizing disruption. IT Alignment: Ensuring IT supports corporate strategy. Infotech (IT Services) Delivers efficient IT solutions to drive ROI:

2.) InfoTech
Data Management:
Privacy, sharing, and streaming solutions using technologies like Microsoft Fabric.
Cybersecurity:
Includes assessments, SOC 2 readiness, audits, and vCISO support to ensure data security and compliance.
Application Development:
Scalable systems for growth, leveraging nearshore teams in Costa Rica.

3.)Recruiting:
Specializes in connecting top talent with client needs: Proprietary Screening Methodology: Identifies the top 10% of candidates. Customized Talent Solutions: Executive searches, staffing, and consulting for long-term success.

4.)Ventures
Invests in innovative solutions to improve lives and communities: Perin Health: A telemedicine and wearable platform for real-time diagnostics. Real Estate: Investments fostering community growth and development.

Community Focus:
We actively support communities where we operate by donating annually to impactful organizations, including Providence Hospice, Sr. Community Services, and Camp Agape.

Vision
We are innovators and changemakers. Through our divisions—Advisory, Infotech, Recruiting, and Ventures—we strive to transform industries, support communities to move humanity forward.

Company Description

Founded in 2014, Sollucio Partners is a community-driven organization dedicated to solving challenges, fostering innovation, and supporting the communities we serve. Our mission is to create transformative services and products that enhance lives, improve businesses, and advance humanity.\r\r4 Divisions (Advisory, Infotech, Recruiting, Ventures).\r\r1.)Advisory\rProvides strategic consulting to help organizations achieve goals, adapt to change, and align IT with business strategies: Fractional CIO Services: On-demand IT leadership. Assessments: Evaluations to identify improvement opportunities. Organizational Change Management: Guiding transitions while minimizing disruption. IT Alignment: Ensuring IT supports corporate strategy. Infotech (IT Services) Delivers efficient IT solutions to drive ROI:\r\r2.) InfoTech\rData Management:\rPrivacy, sharing, and streaming solutions using technologies like Microsoft Fabric.\rCybersecurity:\rIncludes assessments, SOC 2 readiness, audits, and vCISO support to ensure data security and compliance.\rApplication Development:\rScalable systems for growth, leveraging nearshore teams in Costa Rica.\r\r3.)Recruiting:\rSpecializes in connecting top talent with client needs: Proprietary Screening Methodology: Identifies the top 10% of candidates. Customized Talent Solutions: Executive searches, staffing, and consulting for long-term success.\r\r4.)Ventures\rInvests in innovative solutions to improve lives and communities: Perin Health: A telemedicine and wearable platform for real-time diagnostics. Real Estate: Investments fostering community growth and development.\r\rCommunity Focus:\rWe actively support communities where we operate by donating annually to impactful organizations, including Providence Hospice, Sr. Community Services, and Camp Agape.\r\rVision\rWe are innovators and changemakers. Through our divisions—Advisory, Infotech, Recruiting, and Ventures—we strive to transform industries, support communities to move humanity forward.