Director of IT Security

Director Of IT Security

Location: Irvine, CA

Job type: Full-time / Hybrid

Reports to: CIO. Works closely with leaders across IT, Engineering/R&D, QA/Quality, Legal, HR, Finance, and Operations.

Collaborates with parent and sister company Security teams to align standards, share risk and incident intelligence, and coordinate audits and assurance activities while maintaining clear ownership and compliance boundaries.

Based in Irvine, CA. International and domestic travel required for audits, certifications, federal/customer compliance activities, and collaboration with global teams.

Position Summary

The Director of IT Security serves as the company’s security hub and “quarterback”—aligning IT, Engineering/R&D, Quality, Legal, and business leadership around a clear security strategy, and coordinates end-to-end delivery across teams that may not sit within a dedicated security organization.

This role drives prioritization, establishes clear ownership, and coordinates end-to-end security operations, keeps execution moving (risk management, incidents, audits, vendor/security reviews, and training), and provides timely visibility to leadership on posture, gaps, and remediation progress.

In addition, this position owns and coordinates security obligations tied to the National Security Agreement (NSA) and related federal/customer requirements, including audit readiness, documentation, and evidence management—ensuring the organization can demonstrate compliance while maintaining operational efficiency.

Success depends on the ability to influence without authority, create clarity, and prioritize, partnering closely with Engineering/R&D, Quality, Legal, HR, Finance, Operations, and business leaders to embed security into day-to-day operations and product development.

Key Outcomes

• A practical security program that scales with clear priorities, minimal bureaucracy, and measurable risk reduction.
• Audit- and customer-ready security posture (evidence organized, controls operating, owners assigned).
• Cross-functional security ownership: security responsibilities embedded across IT, Engineering, and business teams rather than centralized in a large security staff.
• Reliable incident response, monitoring, and reporting pathways that work with limited tools and people.
• Sustained compliance with NSA obligations and related security plans (e.g., FOCI mitigation artifacts) with predictable cadence and governance.

Key Responsibilities

1) Security Leadership and Governance

• Establish and maintain the company’s security strategy, annual roadmap, and control framework aligned to business priorities and resource constraints.
• Lead a lightweight security governance cadence (e.g., monthly risk review, quarterly executive updates) to drive decisions, remove blockers, and maintain accountability.
• Define security standards, patterns, and guardrails that teams can follow without heavy security staffing.
• Own security policies, exceptions, and compensating controls; ensure policies are practical, adopted, and periodically reviewed.

2) Risk Management

• Maintain an enterprise risk register, including IT, product/engineering, vendor, and compliance risks; drive mitigation plans with clear owners and deadlines.
• Provide security architecture direction for cloud/services, endpoints, identity, networks, and corporate applications—focusing on standardization and simplification.
• Partner with R&D to implement scalable controls (e.g., MFA, least privilege, secure configurations, patching SLAs, logging baselines).

3) Cross-Functional Partnership

• Collaborate with Engineering/R&D to implement secure development practices appropriate for the organization (secure SDLC expectations, code and dependency risk management, environment protections).
• Partner with QA/Quality and Legal to maintain certifications, manage findings, and ensure contractual/regulatory obligations are met.
• Partner with Legal on interpretation of regulatory, NSA, customer, and contractual security obligations, translating requirements into operational controls.
• Influence leaders to build security responsibilities into roles, objectives, and operating routines.
• Partner with parent company and sister company Security teams to align security strategy, standards, and risk posture; share risk and incident intelligence; coordinate on shared controls, incidents, audits, and assurance activities; and ensure efficient information sharing while respecting organizational boundaries, regulatory obligations, and data segregation requirements.

4) Compliance, Audit Readiness & Evidence Management

• Lead planning and coordination for internal, customer, third‑party, parent‑company, and government-related audits/reviews.
• Support review and operationalization of customer and partner security obligations in coordination with Legal, ensuring commitments are implementable and evidence backed.
• Maintain an evidence program: control narratives, procedures, test results, access reviews, training completion, incident records, and corrective actions.
• Support ISO 27001 and other applicable certifications/attestations; ensure alignment and minimize duplicate work across frameworks.

5) National Security Agreement (NSA) & Federal/Controlled Data Responsibilities

• Serve as the primary Security authority accountable for defining sustainable security controls required by the NSA and government‑approved security plans.
• Protect classified, controlled unclassified information (CUI), export‑controlled, and NSA‑governed data through appropriate technical and procedural safeguards.
• Maintain alignment with relevant frameworks and requirements (as applicable), such as NIST, ISO, and GDPR and related customer/government security expectations.
• Support FOCI mitigation requirements by maintaining and operationalizing Technology Control Plans, Electronic Communications Plans, Access Control Plans, and related procedures.
• Ensure monitoring, logging, and escalation processes meet NSA‑driven requirements, including reporting timelines and documentation.

6) Incident Response, Monitoring & Business Continuity

• Own and run incident response planning and execution: triage, containment, investigation, eradication, recovery, and post‑incident improvements.
• Coordinate NSA/customer‑required notifications and reporting when protected data or environments are implicated.
• Ensure pragmatic monitoring and logging coverage with available tooling; define alert thresholds and an escalation model that works with limited staff.
• Partner with business functions on business continuity and disaster recovery planning, tabletop exercises, and periodic restoration testing.

7) Third‑Party/Vendor Security

• Partner with business functions on a right‑sized vendor risk management program: tier vendors, assess risk, review contracts/security addenda, and track remediation.
• Ensure critical vendors meet baseline security requirements (e.g., MFA, breach notification, data handling, subcontractor controls).

8) Security Awareness & Training

• Deliver practical, role‑based security training (general workforce + privileged access users + NSA‑specific training where required).
• Build a culture of “secure‑by‑default” behaviors through concise guidance, easy‑to‑follow playbooks, and recurring communications.

This is a hands‑on leadership role. Sets direction and drives key deliverables (policies, audit evidence, incident leadership, stakeholder alignment), leveraging a combination of internal resources and external partners/MSSPs as needed.

Qualifications

Required

• Bachelor’s degree in Information Security, Computer Science, Information Systems, or equivalent experience.
• 10+ years in information security/IT risk roles with at least 5 years leading security programs or teams.
• Demonstrated experience leading audits and compliance readiness (internal/external/customer), including documentation and evidence management.
• Strong ability to translate security requirements into practical controls in an environment with limited dedicated resources.
• Proven executive communication skills: clear risk narratives and recommendations.

Strongly Preferred

• Experience with NSA environments, FOCI mitigation, or government‑regulated security programs.
• Familiarity with NIST Cybersecurity Framework 2.0, RMF concepts and secure controlled environment practices.
• Experience supporting product development/engineering environments and CI/CD ecosystems.

Preferred Certifications

• CISSP, CISM, CISA, CRISC, or similar.

Core Competencies

• Risk‑based prioritization in resource‑constrained environments
• Cross‑functional governance and stakeholder management
• Audit readiness and evidence‑driven compliance
• Incident leadership and decision‑making under pressure
• Clear writing: policies, procedures, control narratives, and plans
• Integrity, discretion, and national security awareness

Salary Range : $137,500 - $229,500 Annual

This pay range represents the minimum and maximum compensation that the position offers, and final compensation can vary within the range depending on work location, job experience, skills, and relevant educational attainment and/or training.

ETAP requires all successful applicants to undergo and pass a comprehensive background check before they start employment. Background checks will be conducted in accordance with local laws and may, subject to those laws, include proof of educational attainment, employment history verification, proof of work authorization, criminal records, identity verification, credit check. Certain positions dealing with sensitive and/or third‑party personal data may involve additional background check criteria.

ETAP is an Equal Opportunity Employer. We are committed to being an exemplary employer with an inclusive culture, developing a workplace environment where all our employees are treated with dignity and respect. We value diversity and the expertise that people from different backgrounds bring to our business.