Director of Information Security

Our Firm
Sorren is a top 50 national advisory firm that blends deep expertise with a human-first approach. We don’t just work with numbers—we work with people, building lasting relationships and delivering strategic solutions in accounting, assurance, tax, advisory, and private client services. 

At Sorren, we believe that success is a shared journey. Our culture fosters collaboration, innovation, and professional growth, ensuring that every team member has the support and opportunities they need to thrive. We offer a high-performing yet balanced work environment where career development and personal well-being go hand in hand. 

We’re committed to helping you grow, whether that means advancing your career, expanding your expertise, or achieving a fulfilling work-life balance. Because at Sorren, your success is our success. 

Your Journey
Our team members support the firm by delivering timely, accurate work and maintaining clear communication. They take ownership of their development, seek feedback, and build strong relationships. By managing responsibilities effectively and aligning their efforts with firm values, they establish a foundation for long-term success and growth. All team members are expected to excel in Relationships, Communication, Quality Service, Operational Excellence, and Innovation & Growth, contributing to the firm’s success through collaboration, exceptional service, and continuous growth.

Position Summary:

Key Responsibilities:

• Develop, maintain, and execute the firm’s information security program, roadmap, and annual priorities in alignment with business objectives, client obligations, and regulatory expectations.
• Define the security configuration and hardening standards for Microsoft 365 and Entra ID and work in conjunction with the infrastructure team to ensure they are met.
• Set the AV and EDR configuration baseline and make sure security alerting and reporting scale as we grow.
• Define and put in place data protection controls across platforms, including classification, retention, encryption, and DLP.
• Set our email filtering and security posture standards and work with the infrastructure team to ensure they are met. Oversee firewall and network-device patch and update compliance.
• Maintain security policies, technical standards, controls, exceptions, and mature how we audit against them.
• Lead risk assessments[JD1.1], control reviews, and security planning activities across the firm’s infrastructure, applications, endpoints, and cloud services. This includes identifying risks, prioritizing remediation, tracking corrective actions, and validating closure
• Own risk register and tracking and run security and vendor risk assessments as the practice matures.
• Build and run the firm’s GLBA and FTC Safeguards program, accounting for other requirements such as HIPAA, PCI DSS, and state privacy laws (for example CCPA and CPRA) where applicable.
• Support client security reviews, cyber insurance requirements, and regulatory or contractual compliance efforts by preparing evidence, documenting controls, and coordinating remediation plans.
• Set up recurring system access reviews and support internal and external audit needs, including evidence collection.
• Maintain the incident response plan and be the point person for incident response activities, including any communication, coordinating external responders, and documentation. 
• Plan and facilitate periodic incident response tabletop exercises and post-exercise improvement activities.
• Run and coordinate vulnerability scans and penetration tests and track remediation to closure.
• Own the security awareness and phishing simulation program, including strategy, reporting, and continuous improvement.
• Evaluate, direct, and hold managed-security and security-tool vendors accountable for results, while continuously assessing the effectiveness of current security partnerships and recommending changes where appropriate.
• Conduct security and risk assessments of proposed software, services, and vendor relationships as part of the software request and approval process.
• Take part in security due diligence on acquisition targets and document their security posture to inform integration.
• Maintain awareness of evolving cyber threats, regulatory developments, and leading practices relevant to professional services and accounting firms, and translate them into practical improvements.

Required Qualifications:

• 7+ years of progressive IT and security experience, including 3 or more years hands on in information security. 
• Proven ability to plan security controls and implement them yourself.
• Deep hands-on experience securing Microsoft 365 and Entra ID (Conditional Access, MFA, Microsoft Defender, mail-flow and email authentication) and managing endpoints with Intune.
• Practical experience with EDR and AV, vulnerability scanning, access reviews, and coordinating incident response.
• A track record of delivering results through managed-security and vendor partners, including evaluating them, directing their work, and holding them accountable.
• Working knowledge of regulatory and compliance requirements for financial or professional services data, including GLBA and FTC Safeguards and general privacy and compliance frameworks.
• Experience maintaining security policies and a risk register and turning them into implemented controls.
• Strong communication and collaboration skills, with the ability to coordinate across the Infrastructure, Support, and business teams to get changes done.

Preferred Qualifications:

• Experience in professional services, accounting, or another regulated, financial-data environment.
• Experience integrating or standardizing security across a multi-location or acquisitive (M&A) organization.
• Familiarity with hosted or virtual desktop platforms and the vendor management that goes with them.
• Relevant certifications such as CISSP, CISM, CISA, CRISC, Microsoft security certifications, or similar credentials.

Compensation range for this role is $135,000 - $160,000.

Actual compensation is influenced by a variety of factors including but not limited to skills, experience, qualifications, and geographic location. Discretionary incentive compensation is based on firm, group, and individual performance.

Why Choose Us? 

At Sorren, we’re invested in your growth—both personally and professionally. We’ll support you as you advance in your career while also giving you the flexibility to enjoy life outside of work. We believe balance fuels success, and we’ve designed our culture and benefits to reflect that.

What We Offer*:

• Generous paid time off
• Comprehensive medical, dental, and vision coverage, plus life and disability insurance
• 401(k) retirement savings plan
• Paid holidays, including a firmwide winter break (December 24 – January 1)
• Paid parental leave (available after one year of service)
• Mentorship and career development programs
• CPA exam support to help you succeed on the path to licensure
• Firm-sponsored events and spontaneous team activities
• Celebrations to mark milestones like the end of busy season and the holidays

*Benefits are available to full-time employees regularly scheduled to work at least 30 hours per week.

© 2025 “Sorren” is the brand name under which Sorren CPAs, P.C. and Sorren, Inc. and its subsidiary entities provide professional services. Sorren CPAs P.C. and Sorren, Inc. and its subsidiary entities practice as an alternative practice structure in accordance with the AICPA Code of Professional Conduct and applicable laws, regulations, and professional standards. Sorren CPAs P.C. is a licensed independent CPA firm that provides attest services to its clients, and Sorren, Inc. and its subsidiary entities provide tax and business consulting services to their clients. Sorren, Inc. and its subsidiary entities are not licensed CPA firms.