Director, Cybersecurity and IT Risk Management

About Source America

Source America is a mission-driven nonprofit and Ability One-authorized enterprise that helps create employment opportunities for people with disabilities by building strong partnerships with the federal government and a nationwide network of nonprofit agencies. We connect federal customers with high-quality products and services while strengthening the capabilities of nonprofit agencies and the people they employ. More information can be found rce America.org/who-we-are

We are seeking a Director, Cybersecurity and IT Risk Management to provide strategic leadership and operational oversight for Source America’s cybersecurity, technology risk management, security governance, incident response, third-party risk management, security awareness, and compliance readiness programs. This leader will serve as a trusted advisor to IT leadership, executive leadership, business stakeholders, governance bodies, and partners on cybersecurity risk, regulatory and contractual obligations, cyber resilience, and secure technology enablement.

This is a high-impact leadership opportunity for a cybersecurity executive who can balance mission, risk, compliance, and business enablement in a federal-contracting and nonprofit environment. The Director will help protect Source America’s information assets, systems, mission, and federal contracting obligations while also supporting nonprofit agency partners where federal contracts, Controlled Unclassified Information, or technology risk obligations apply.

Source America offers both a hybrid and remote work model.
** Due to the requirements of this position, the ideal candidate would live within 30 commuting miles or less of the Source America's National Office in Vienna, VA and work 2-3 days per week in the office.

• Lead Source America’s cybersecurity, technology risk management, and security governance functions.
• Develop and execute the enterprise cybersecurity strategy and roadmap aligned to organizational goals, federal contractor obligations, Ability One operational responsibilities, and risk tolerance.
• Own the cybersecurity risk management framework, including risk assessment methodology, risk register, mitigation tracking, accepted risk documentation, and executive-level reporting.
• Lead readiness and ongoing compliance activities for CMMC, NIST SP 800-171, Controlled Unclassified Information protection requirements, GSA CUI handling requirements, and other applicable federal, contractual, and regulatory security obligations.
• Oversee security operations, including threat monitoring, vulnerability management, incident response, threat mitigation, control validation, and user awareness training.
• Lead cybersecurity incident response activities, including investigation, containment, recovery, executive communication, lessons learned, and remediation tracking.
• Build and lead cybersecurity components of third-party risk management, including vendor risk tiering, due diligence, contract security requirements, cloud/SaaS assessments, ongoing monitoring, and remediation tracking.
• Provide security oversight for enterprise systems, cloud platforms, data platforms, artificial intelligence solutions, automation, and major technology initiatives.
• Support AI governance by assessing cybersecurity, privacy, data protection, vendor, and operational risks associated with approved and emerging AI tools.
• Present cybersecurity metrics, risk posture, control effectiveness, incident trends, vulnerability remediation, compliance readiness, and security program maturity to inform executive decision-making.

The salary for this position falls in a range between $170,000 - $180,000 depending on your experience and geographic location in the United States.

• Bachelor’s degree required; master’s degree, MBA, or relevant advanced training preferred.
• 15+ years of relevant cybersecurity, technology risk, security governance, or compliance experience.
• 10+ years of management experience, with demonstrated ability to lead staff, vendors, managed security service providers, and cross-functional partners.
• Current CISSP, CISM, CRISC, CISA, CGRC,…