Senior Director, IT Security

Benefits

• Competitive base pay and performance bonuses, dependent on role
• Medical, dental, vision, telemedicine, supplemental insurance benefits, long‑term and short‑term disability
• 401K with employer match and 100% immediate vesting
• Paid Time Off (PTO) and paid company holidays to help you balance work and personal life
• Paid Volunteer Time Off (VTO) annually
• Tuition Reimbursement
• Parental Leave
• Business casual work environment

The Senior Director, IT Security is responsible for the strategic leadership, governance, risk management, compliance, and operational execution of the enterprise information security program. This position provides oversight of cybersecurity operations, security architecture, technology risk management, regulatory compliance, third‑party risk management, incident response, business continuity, disaster recovery, and emerging technology governance, including artificial intelligence initiatives. The role serves as a trusted advisor to executive leadership, regulators, auditors and business stakeholders to ensure the confidentiality, integrity and availability of company information assets while enabling business growth, innovation and regulatory compliance.

• Develop and maintain the enterprise cybersecurity strategy, operating model, control framework and multi‑year security roadmap aligned to business objectives.
• Establish and maintain enterprise security governance processes, standards, policies, risk assessments, control evaluations and remediation programs.
• Provide cybersecurity governance reporting, risk metrics, annual program updates and material cyber‑risk reporting to executive leadership, board committees, regulators, auditors and external stakeholders.
• Lead enterprise cybersecurity incident response, crisis management, investigations, post‑incident remediation and coordination of third‑party security events.
• Oversee vulnerability management, threat detection, threat intelligence, security monitoring and security operations capabilities.
• Direct implementation and management of security technologies including SIEM, EDR, DLP, IAM, PAM, cloud security and related cybersecurity platforms.
• Serve as the primary security liaison for regulatory examinations, external audits, compliance assessments and cybersecurity reviews, including evidence collection, artifact management, response coordination and remediation tracking.
• Maintain compliance with applicable regulatory and industry frameworks including GLBA, NYDFS, FTC Safeguards Rule, PCI DSS, NIST CSF, CIS Controls and other applicable requirements.
• Oversee third‑party cybersecurity risk management, vendor security assessments, critical service‑provider monitoring and regulatory vendor‑risk reporting; establish governance, security, approval, monitoring and risk management requirements for artificial intelligence, automation platforms, integrations and emerging technologies.
• Partner with infrastructure, cloud, data and application development teams to integrate security‑by‑design principles into architecture, Dev Sec Ops , infrastructure as code and technology modernization initiatives.
• Oversee cybersecurity awareness, policy communication, role‑based security training, business continuity, disaster recovery, cyber resilience planning, testing and reporting.
• Develop departmental objectives, performance metrics, staffing strategies, succession plans and talent development programs for security personnel.
• Lead special projects and perform additional responsibilities as required to support the organization’s strategic objectives.

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, Computer Science, Risk Management, Business Administration or related field required;
  Master’s degree preferred.
• Minimum ten (8) years of progressive experience in cybersecurity, technology risk, audit, compliance or information security leadership roles.
• Minimum five (5) years of leadership experience managing security teams, security programs or enterprise risk functions.
• Demonstrated experience leading enterprise cybersecurity programs within a regulated industry environment.
• Str…