Senior Director, Chief Information Security Officer

Cambridge, MAG&A – Information Technology /On-siteScholar Rock is a late-stage global biopharmaceutical company focused on developing and commercializing apitegromab for children and adults with spinal muscular atrophy (SMA) and other rare, severe, and debilitating neuromuscular diseases. As a global leader in myostatin biology, a field focused on proteins that regulate muscle mass, the Company is named for the visual resemblance of a scholar rock to protein structures. Our commitment to unlock fundamentally different treatment approaches is powered by broad application of a proprietary platform, which has developed novel monoclonal antibodies to modulate protein growth factors with extraordinary selectivity. Scholar Rock works every day to create new possibilities for patients through its highly innovative anti-myostatin program, including opportunities in additional rare neuromuscular diseases. Learn more at ScholarRock.com and follow @ScholarRock on X and on LinkedIn.Summary of Position:Scholar Rock is seeking a Senior Director, Cybersecurity to serve as the company’s Chief Information Security Officer, responsible for building and scaling enterprise cybersecurity capabilities that protect the organization’s people, data, technology assets, intellectual property, and business operations.Reporting to the CIO, this role defines and executes the cybersecurity strategy and roadmap in partnership with enterprise stakeholders across technology, Legal, Privacy, HR, Finance, Quality, and business functions.The successful candidate combines strategic leadership with hands-on execution, with deep expertise across cybersecurity architecture, engineering, operations, governance, risk management, and compliance. This leader will build scalable, risk-based cybersecurity capabilities for a growing biotechnology company, balancing current operational needs with the maturity required to support commercial growth, regulatory readiness, and future organizational scale.This role is ideal for a cybersecurity leader who has successfully led multiple cybersecurity functions and is ready to assume broader enterprise cybersecurity leadership responsibilities in a lean, high-growth biotechnology environment.Position ResponsibilitiesCybersecurity Strategy & Program LeadershipDefine and execute the enterprise cybersecurity strategy, roadmap, priorities, and operating modelEstablish cybersecurity governance, policies, standards, and control frameworks aligned with business objectives and organizational growthPrioritize cybersecurity maturity initiatives based on business risk, regulatory expectations, commercial growth, and organizational scaleDrive continuous improvement of cybersecurity capabilities and maturity across the organizationServe as the primary cybersecurity advisor to the CIO, Board of Directors, and business leadershipTranslate cybersecurity risks and opportunities into clear, actionable business recommendationsSecurity Architecture & EngineeringOwn the cybersecurity target-state architecture and security technology roadmapLead cybersecurity architecture and engineering across cloud, infrastructure, identity, endpoint, network, application, SaaS, and data environmentsEmbed secure-by-design and risk-based security principles across enterprise initiatives and technology platformsPartner with technology teams to integrate security requirements into solution design, implementation, and operational support modelsEvaluate, select, and optimize cybersecurity technologies and services that support business and regulatory requirementsSecurity Operations & Cyber ResilienceOwn security operations capabilities, including vulnerability management, incident response, security monitoring, identity security, and cyber resilienceEstablish and mature detection, response, recovery, and continuous improvement capabilitiesLead cybersecurity incident response activities, executive communications, and post-incident reviewsPartner with technology teams and service providers to strengthen operational security capabilities and reduce enterprise riskSupport business continuity, disaster recovery, and cyber resilience planning in partnership with IT and business stakeholdersGovernance, Risk & ComplianceLead the enterprise cybersecurity governance, risk, and compliance programEstablish and maintain cybersecurity risk management processes, risk assessments, remediation plans, and risk reportingSupport SOX IT General Controls, user access governance, change management controls, and third-party risk management activitiesMaintain alignment with the NIST Cybersecurity Framework and applicable regulatory requirementsDevelop meaningful cybersecurity metrics, KPIs, KRIs, and executive reportingPrepare cybersecurity risk, maturity, roadmap, and investment updates for senior leadership and audit committee discussions, as appropriateData Protection & PrivacyLead cybersecurity capabilities to protect sensitive company data, intellectual property, clinical data, regulated information, and business-critical recordsPartner with Legal, Privacy, Quality, Data & Analytics, and business stakeholders to support data governance, data classification, access controls, and security-related privacy requirementsStrengthen data protection capabilities across cloud, SaaS, endpoint, collaboration, and enterprise application environmentsSupport implementation of privacy-by-design and least privilege principles in alignment with regulatory and business requirementsPartner with Legal and Privacy on security considerations related to data protection, privacy obligations, vendor risk, and evolving regulatory expectationsAudit, Quality & Regulatory ReadinessServe as the cybersecurity lead for internal audits, external audits, inspections, and cybersecurity assessmentsPartner with Privacy, Legal, Quality, and IT stakeholders to ensure cybersecurity controls support compliance obligationsEnsure cybersecurity controls support GxP-regulated systems, Computer System Validation, and data integrityDrive timely remediation of audit findings, observations, and control deficienciesVendor & Managed Service LeadershipDefine and lead the cybersecurity operating model, leveraging internal teams, managed service providers, consultants, and strategic partnersOwn strategic relationships with cybersecurity vendors, MSSPs, consultants, and external partners, including governance, performance management, and accountabilityEstablish service expectations, SLAs, KPIs, KRIs, operational metrics, and accountability mechanisms for third-party providersConduct operational and executive-level performance reviews to ensure cybersecurity services meet business, compliance, regulatory, and operational objectivesPartner with Procurement, Legal, Finance, and IT leadership on vendor selection, contract negotiations, renewals, investment decisions, and build vs. buy vs. outsource decisionsExecutive Communication & Business PartnershipDevelop and deliver cybersecurity strategy updates, risk assessments, roadmap reviews, audit results, and investment recommendations to senior leadershipCommunicate cybersecurity risks and opportunities in clear business, operational, regulatory, and financial termsBuild trusted relationships across business and technology functionsInfluence enterprise decision-making through practical, risk-based recommendations and effective stakeholder managementServe as a pragmatic advisor who enables business growth while maintaining appropriate risk disciplinePeople LeadershipLead, coach, mentor, and develop cybersecurity personnel and security-focused resourcesProvide leadership across employees, contractors, consultants, and managed service providersFoster a culture of accountability, continuous improvement, collaboration, and operational excellenceHelp shape the future cybersecurity organization as the company continues to scaleBuild a security culture that is practical, business-aligned, and appropriate for a growing commercial biotechnology companyCandidate Requirements Bachelor’s degree in Information Security, Computer Science, Engineering, Information Technology, or a related discipline12+ years of progressive cybersecurity experience with increasing leadership responsibilitiesDemonstrated leadership experience spanning cybersecurity architecture, engineering, and operational security functionsExperience building, implementing, or maturing enterprise cybersecurity programs and capabilitiesExperience leading cybersecurity initiatives within regulated environmentsStrong knowledge of the NIST Cybersecurity Framework, cybersecurity governance, risk management, and security control implementationExperience supporting audits, compliance programs, risk assessments, and remediation activitiesExperience with data protection, access governance, third-party risk, and security controls for cloud, SaaS, endpoint, and enterprise application environmentsExperience managing cybersecurity vendors, managed service providers, and outsourced security servicesProven ability to communicate effectively with executive leadership and influence organizational decision-makingStrong presentation, communication, and stakeholder management skillsCISSP certification requiredPreferred QualificationsExperience in biotechnology, pharmaceutical, life sciences, healthcare, or medical device industriesExperience supporting GxP-regulated systems, Computer System Validation, Quality Management Systems, and inspection readiness activitiesExperience supporting SOX compliance and IT General ControlsFamiliarity with cloud security, identity and access management, vulnerability management, data protection, cybersecurity operations, and cyber resilience programsExperience partnering with Legal and Privacy teams on data protection, privacy-by-design, data classification, access control, and vendor risk considerationsExperience supporting commercial-stage companies through growth, scale, geographic expansion, or increasing regulatory complexityCISM, CRISC, CCSP, GIAC, CISA, or ISO 27001 certifications preferred$245,000 - $325,000 a yearScholar Rock is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.