Director of Cybersecurity

Director of Cybersecurity

The Director of Cybersecurity will serve as the primary cybersecurity leader for the enterprise, responsible for maturing the security program and providing practical architectural guidance where security, infrastructure, cloud, applications, data protection, and integration decisions intersect.

The primary focus of this role is cybersecurity leadership: policy, vulnerability management, incident response, identity and access management, data protection, risk management, security awareness, and security infrastructure that supports GDPR and other data protection standards. Enterprise architecture is a supporting responsibility, focused on helping ensure major technology decisions are secure, scalable, supportable, and aligned with business needs.

This is a builder role for a hands‑on, practical leader who can mature a developing security program, partner effectively across IT and the business, and help strengthen enterprise architecture technology decisions.

What You’ll Be Doing

• Own and mature the enterprise cybersecurity program, including policies, standards, controls, reporting, continuous improvement, and security infrastructure in support of GDPR and other data protection standards.
• Lead vulnerability management, including prioritization, remediation tracking, and measurable reduction of critical and high‑risk findings.
• Operationalize incident response through playbooks, escalation procedures, tabletop exercises, live drills, and coordination with the outsourced SOC.
• Lead identity and access management governance, including privileged access, access reviews, account lifecycle controls, Microsoft Entra ID / Microsoft 365 security capabilities, and access controls that support data protection and privacy requirements.
• Support data protection and privacy‑related security controls, including encryption, logging, access governance, auditability, retention considerations, and safeguards for sensitive information.
• Manage the relationship with the outsourced SOC and other security partners, including service expectations, escalation processes, and performance reporting.
• Manage, coach, and develop Security Analyst resources and help define how the security function should be scaled over time.
• Align the security program to NIST Cybersecurity Framework and CIS Controls in a practical, risk‑based manner.
• Maintain a security risk register and communicate security posture, data protection risks, remediation priorities, and progress to the CIO and executive leadership as needed.
• Contribute practical security architecture standards and reference patterns where they directly affect identity, cloud, infrastructure, applications, data protection, integration, and overall technology risk.
• Provide security‑centered review and guidance for major technology initiatives to ensure solutions are secure, supportable, scalable, privacy‑aware, and aligned with enterprise direction.
• Partner with infrastructure, application development, data, and platform teams to support secure, practical technology decisions.
• Support technology and vendor evaluations by providing security due diligence, technical review, and risk‑based recommendations.
• Communicate complex cybersecurity, technology risk, and architecture‑related issues clearly to technical teams, business stakeholders, and executive leadership.

Qualifications

• 10 plus years of progressive information technology experience, including at least 5 years in cybersecurity leadership, information risk, security engineering, or security architecture.
• Demonstrated experience owning or materially maturing a cybersecurity program.
• Experience with vulnerability management, incident response, identity and access management, security policy, data protection controls, and risk reporting.
• Experience supporting security infrastructure or controls aligned with data privacy and protection requirements such as GDPR, ISO 27001, or comparable standards.
• Hands‑on knowledge of Microsoft Azure, Microsoft 365 security capabilities, Entra ID, hybrid infrastructure, and modern identity practices.
• Working knowledge of NIST Cybersecurity Framework and CIS Controls; familiarity with ISO 27001, GDPR, or other data protection standards is a plus.
• Experience working with outsourced SOC providers, security monitoring tools, vulnerability tools, and security service providers.
• Ability to provide practical security guidance across multiple technology domains, especially where security, privacy, data protection, and risk are involved.
• Experience managing, mentoring, or developing security or technical staff.
• Strong written and verbal communication skills, with the ability to present effectively to technical and executive audiences.
• CISSP, CISM, CCSP, CISA, Azure security or architecture certification, or comparable certification preferred; equivalent experience will be considered.