Director of Cyber Security

The Director of Cyber Security is a senior leadership role responsible for developing and executing a comprehensive information security strategy that safeguards the organization’s digital assets, systems, and data. This role oversees all aspects of cybersecurity operations, ensuring alignment with business objectives and maintaining regulatory compliance and operational resilience.

The Director leads a multidisciplinary team—including managers, project managers, architects, analysts, engineers, and third-party providers—and collaborates closely with cross-functional stakeholders to embed security into enterprise initiatives, including digital transformation and cloud adoption. Effective communication with both technical and non-technical audiences is essential.

Key challenges include staying ahead of rapidly evolving cyber threats and regulations, balancing security with business agility, managing limited resources, and fostering a culture of security awareness and engagement. The Director is expected to remain current on industry trends, emerging technologies, and best practices through ongoing learning and professional involvement. Success in this role is measured by:

• Reduction in security incidents and breaches
• Compliance with relevant regulations and frameworks
• Employee participation in security awareness programs
• Improved Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
• Completion rates of third-party risk assessments
• Positive audit outcomes and timely remediation

The principal duties and responsibilities include, but are not limited to the following:

• Strategic Leadership: Demonstrates hands‑on leadership by working closely with both team members and cross‑functional business units to drive alignment and deliver results. Develop and implement a comprehensive information security strategy aligned with organizational goals and regulatory requirements. Regularly review and refine the security roadmap to address emerging threats and technological advancements.
• Risk Management: Identify, assess, and mitigate cyber risks across all business units and functions. Conduct security risk assessments, oversee vulnerability management, and ensure compliance with applicable laws, guidelines, and best practices.
• Policy and Governance: Create, update, and enforce security policies, standards, and procedures. Establish security governance frameworks and ensure organization‑wide adoption and awareness.
• Incident Response: Lead the organization’s response to cyber security incidents and breaches. Develop and maintain incident response plans, coordinate cross‑functional teams during incidents, and oversee post‑incident analysis and reporting.
• Security Operations: Supervise daily security operations, including monitoring, threat intelligence, and log analysis. Implement technical controls such as firewalls, encryption, intrusion detection systems, and endpoint protection.
• Talent Management: Recruit, mentor, and manage a high‑performing cyber security team. Foster professional development, provide training opportunities, and determine staffing requirements (both internal and external) to ensure defined objectives are met. Manage performance evaluations and salary administration for direct and indirect reports. Guide the professional and personal development of associates, including certifications and/or degrees as required by the role.
• Budget and Resource Management: Oversee the cyber security budget, ensuring resources are allocated efficiently to maximize risk reduction. Evaluate investments in technology, services, and personnel. Administer departmental operating and capital budgets.
• Stakeholder Communication: Serve as the primary liaison between executive leadership and the cyber security function. Deliver clear, concise reports and recommendations to leadership, regulators, and the board of directors.
• Vendor and Third‑Party Security: Evaluate and manage security risks associated with vendors, partners, and supply chain entities. Lead third‑party risk assessments and integrate findings into the broader risk management strategy.
• Vendor and Third Parties: Evaluate and manage vendors, partners,…