Associate Director​/Director, Information Security

Axsome Therapeutics is a biopharmaceutical company leading a new era in the treatment of central nervous system (CNS) conditions. We deliver scientific breakthroughs by identifying critical gaps in care and develop differentiated products with a focus on novel mechanisms of action that enable meaningful advancements in patient outcomes. Our industry‑leading neuroscience portfolio includes FDA‑approved treatments for major depressive disorder, excessive daytime sleepiness associated with narcolepsy and obstructive sleep apnea, and migraine, and multiple late‑stage development programs addressing a broad range of serious neurological and psychiatric conditions that impact over 150 million people in the United States.

Together, we are on a mission to solve some of the brain’s biggest problems so patients and their loved ones can flourish. For more information, please visit us at and follow us on Linked In and X.

Axsome Therapeutics is seeking an Associate Director/Director Information Security to take a leadership role in threat management, incident response, and vulnerability management functions. Operating as a hands‑on leader, this role directs the cybersecurity team and service providers while remaining actively engaged in technical work. The role executes and advances the corporate Information Security Program and Management System owned by the Head of Information Security, and responsible for maintaining our security posture during non‑standard hours, including active weekend and evening monitoring and rapid response to high‑priority security incidents, and perform additional responsibilities as assigned by IT leadership.

The Associate Director/Director Information Security will report to the Sr. Director, Information Security.

This role is based at Axsome’s HQ in New York City with an on‑site requirement of at least three days per week. We are unable to consider candidates who are looking for fully remote roles.

• Lead security monitoring and detection across MSP, SIEM, IDS/IPS, and the broader security toolset; personally triage, analyze, and elevate high‑severity alerts
• Set alert prioritization and detection‑engineering standards; directly tune detections, correlation rules, and use cases to improve signal quality
• Perform hands‑on threat hunting with advanced techniques and tooling; operationalize hunting strategies and resulting mitigations
• Drive continuous improvement of security controls based on threat intelligence, hunt findings, and incident trends

• Act as incident lead for significant business‑impact security events, leading identification, containment, eradication, and recovery — including direct investigation and forensic analysis
• Maintain and mature incident response plans, runbooks, and playbooks; alert optimization; design and lead tabletop exercises to validate readiness
• Lead post‑incident reviews, author executive‑facing reports, and drive remediation of process and control gaps

• Lead the vulnerability management program; execute or validate scans, analyze results, and confirm remediation
• Apply risk‑based prioritization and remediation SLAs aligned to business impact; report progress and residual risk
• Partner with IT Infrastructure & Operations and Application Development to drive timely patching and configuration hardening

• Manage the cybersecurity vendor and MSP relationships; ensure effective service delivery and enforce SLAs
• Define provider KPIs; lead service reviews and drive continuous improvement
• Manage the Third‑Party Risk Management (TPRM) program — vendor assessments, risk ratings, contract security…