Director of Security & Compliance

This role is intentionally independent from Infrastructure. The Director will provide dedicated cybersecurity leadership, budget ownership, governance, escalation, and risk-based decision support while partnering closely with Infrastructure, Applications, User Support, Legal, Compliance, Finance, HR, plant leadership, and external partners.

The company is moving to a future-state global IT shared services model with a standalone Security and Compliance tower. This role closes a key cybersecurity leadership gap and provides one accountable owner for enterprise cybersecurity strategy, governance, risk reduction, incident readiness, compliance, and executive reporting. The role is critical to protecting manufacturing operations, intellectual property, customer trust, business continuity, and future scalability.

• Establish and lead the enterprise cybersecurity and compliance program across global business units and manufacturing sites.
• Develop and maintain a cybersecurity strategy, operating model, governance cadence, policy roadmap, risk register, and executive reporting framework.
• Align the program to recognized cybersecurity frameworks and business risk priorities, using practical, maturity-based approaches such as NIST CSF and Zero Trust principles where appropriate.
• Define clear roles, responsibilities, escalation paths, and decision rights across Security, Infrastructure, Applications, User Support, Legal/Compliance, and business stakeholders.
• Build and lead the Security and Compliance team, including coaching two Cybersecurity Analysts and coordinating the SIEM/SOC managed service.

• Select, implement, operationalize, and continuously improve the company’s SIEM/SOC managed service.
• Define alert triage, escalation, severity classification, incident handoff, reporting, and SLA expectations with the managed service provider.
• Ensure telemetry coverage across priority sources such as endpoint, identity, network, cloud/SaaS, critical applications, and infrastructure.
• Partner with Infrastructure and Applications to improve logging, monitoring, detection, containment, and response readiness.
• Track detection and response metrics, recurring incident themes, false positives, and control gaps.

• Own and mature the cybersecurity incident response program, including playbooks, tabletop exercises, breach escalation workflows, post-incident reviews, and corrective-action tracking.
• Partner with Infrastructure and business teams on disaster recovery planning for Tier 1 systems, including identity, access, monitoring, backup testing, cyber recovery, and communications dependencies.
• Ensure cybersecurity considerations are embedded into disaster recovery, backup testing, and business continuity planning.
• Lead major cybersecurity incident coordination in partnership with IT, Legal, HR, Communications, executive leadership, vendors, and external counsel as needed.

• Lead identity-centric security improvements across Microsoft Entra , Active Directory, privileged access, MFA, Conditional Access, SSO, device trust, and access reviews.
• Advance Zero Trust initiatives where appropriate, including least privilege, segmentation, device compliance, identity-driven access, and continuous verification.
• Partner with Infrastructure and User Support on endpoint management, Intune, Crowd Strike, patching, device compliance, and secure configuration baselines.
• Drive privileged-access governance, joiner/mover/leaver control discipline, and periodic access reviews for critical systems.

• Establish a risk-based vulnerability management program, including scanning, prioritization, remediation SLAs, exception handling, and reporting.
• Partner with Infrastructure, Applications, and plant/site teams to remediate critical vulnerabilities, unsupported systems, exposed services, configuration gaps, and segmentation issues.
• Coordinate penetration testing, vulnerability assessments, security assessments, and remediation tracking.
• Maintain dashboards showing vulnerability aging, remediation progress, endpoint coverage, MFA coverage, incident metrics, and risk trends.

• Lead NIS2 readiness activities, including gap remediation, evidence management, policy updates,…