Director of Information Security

Director of Information SecurityThe Director of Information Security is responsible for establishing and leading the organization's enterprise cybersecurity program. This position provides strategic and operational leadership across security operations, governance and compliance, data protection, DevSecOps, incident response, and network security.The Director will develop the security roadmap, establish policies and controls, oversee enterprise risk, and ensure appropriate protection of systems, applications, networks, and sensitive information. The role works closely with executive leadership, IT, network engineering, legal, audit, HR, and business stakeholders to ensure cybersecurity initiatives support organizational priorities and regulatory obligations.This position also serves as a senior escalation point for significant security events and is responsible for communicating cybersecurity risks, program performance, and remediation priorities to executive leadership.RequiredBachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline, with at least 10 years of progressive cybersecurity or information security experience. Equivalent experience may be considered in lieu of a degree.At least 5 years of experience managing and developing technical security teams.Demonstrated leadership across multiple cybersecurity disciplines, including Security Operations, GRC, Data Security/Governance, DevSecOps, and network security.Strong understanding of established cybersecurity frameworks and regulatory standards, including NIST, ISO 27001, CIS Controls, PCI-DSS, SOX, and applicable privacy requirements.Strong knowledge of enterprise security architecture and technologies, including firewalls, IDS/IPS, VPN, network segmentation, Zero Trust, SIEM, EDR/XDR, and identity and access management.Experience managing security budgets, technology investments, licensing, contracts, vendors, and third-party service providers.Demonstrated experience directing enterprise incident response from initial investigation through containment, remediation, recovery, and post-incident review.Experience working with internal audit teams, external auditors, regulators, customers, and third-party security assessors.Ability to evaluate complex cybersecurity risks and communicate their business impact to executives and other non-technical stakeholders.Excellent written and verbal communication skills in English.Strong analytical and problem-solving capabilities, including the ability to evaluate information, identify root causes, and make sound decisions.Ability to remain effective in high-pressure situations, including during cybersecurity incidents and other critical events.Strong interpersonal and relationship-building skills with executives, employees, vendors, auditors, and external partners.Ability to manage multiple priorities while balancing long-term strategic initiatives with day-to-day security operations.Willingness to work outside standard business hours when required, including evenings, weekends, holidays, and on-call rotations for critical security matters.PreferredMaster's degree in Cybersecurity, Information Systems, Business Administration, or a related field.Professional certifications such as CISSP, CISM, CISA, CRISC, CCSP, or comparable credentials.Experience working within a highly regulated environment such as financial services, healthcare, energy, or another compliance-driven industry.Familiarity with regulatory requirements including SOX, HIPAA, GLBA, NERC-CIP, or similar standards.Experience presenting cybersecurity strategy, risk, and program performance to executive leadership, audit committees, or boards.Experience developing enterprise security programs during periods of organizational growth, transformation, or technology modernization.