Director, Information Security

100% Remote (WFH) Opportunity

The Director of Information Security’s role is to keep the program running with discipline and ensures security design thinking is present at every major technology decision. Security architecture is not a separate function layered on top: it is embedded in this role by design.

• Keep the Program on Track
  • Own the security program roadmap: monitor progress against Phase 1 milestones, surface blockers early, and scale to the CISO with recommended actions rather than status reports
  • Begin technology portfolio rationalization in Phase 1: the strategy's three-year cost projection depends on this work starting immediately, not in Phase 2
  • Manage the security budget with visibility into spend, variance, and vendor commitments across the full portfolio
  • Own and evolve all security vendor relationships for non-MDR contracts: renewals, performance reviews, and contract alignment with program direction
  • Maintain the technology portfolio inventory and rationalization tracker actively from Month 1
• Own Security Architecture
  • Serve as the program's embedded security architect, ensuring security design principles are present at every major technology decision
  • Own the security architecture function in the absence of a separate Security Architect position: this is a deliberate consolidation, not a capability gap
  • Participate in all major technology design reviews with particular focus on the bifurcated cloud footprint: AWS for workloads and AI functions;
    Azure for Dynamics 365, M365, and Entra
  • Drive the on-premises Active Directory deprecation plan in Phase 1 as a prerequisite for identity consolidation
  • Maintain alignment between the IAM modernization project and the CISO organization's security design requirements
• Drive Cross-Functional Coordination
  • Serve as the CISO's proxy in cross-functional meetings where security perspective is needed but the CISO is unavailable
  • Coordinate security engagement across active modernization programs (Dynamics 365 CRM, AI adoption, digital distribution) to ensure design-stage participation is consistent and tracked
  • Manage the compliance coordination model with the GRC function to ensure no regulatory deadline is missed
  • Drive the ERM partnership cadence with BCP/DR program owners
• Own Continuous Improvement
  • Track every nonconformity, corrective action, and after-action finding to closure
  • Own the program metrics dashboard: translate operational data into executive-ready reporting for the CIO and Board
  • Lead the quarterly program review cycle and annual strategy refresh process

• Seven or more years in technology leadership, security program management, security architecture, or equivalent operational leadership
• Demonstrated experience managing complex, cross-functional programs with a small team
• Familiarity with security program governance, vendor management, and budget operations
• Experience in regulated industries and comfort navigating compliance calendars and audit cycles
• Track record of delivering program outcomes in environments where structure must be built, not inherited
• Leadership and Judgment
  • Exceptional organizational and communication skills: this role runs on clarity and follow-through
  • Comfortable operating with ambiguity and exercising independent judgment when the CISO is not available
  • Ability to build credibility across functions without formal authority
  • Orientation toward outcomes and accountability: tracks what matters, drops what does not
• Technical Scope
  • Security architecture familiarity: cloud security design across AWS and Azure, identity and access management, and zero-trust principles
  • Working knowledge of security program frameworks (NIST CSF, ISO 27001 principles) sufficient to manage against them
  • Famil…