Director, Information Security

Short Description

Bowman has an opportunity for a Director, Information Technology to join our team in Reston, VA.

Bowman has an opportunity for a Director, Information Technology to join our team in Reston, VA. At Bowman, we believe in creating opportunities for aspiring people to thrive and achieve ambitious goals. That’s why a career at Bowman is more than a job. It is an opportunity to be part of a diverse and engaged community of professionals, to be treated as a respected and valued member of a motivated team and to be empowered to do exceptional work that advances the best interest of everyone involved.

We recognize the importance of creating a work environment that is both rewarding to our employees and supportive of our unwavering commitment to provide unparalleled service to our clients.

Purpose

The Director of Information Security leads the enterprise security function to protect information assets and manage risk across the organization. This position is responsible for strategic oversight and leadership across all major security domains, including endpoint security, vulnerability management, infrastructure security, cloud security, logging and detection, data protection, application security, GRC, and incident response. The Director will align security initiatives with business objectives, develop a robust security architecture, ensure regulatory compliance, and foster a culture of cybersecurity awareness.

The role includes managing hands-on security professionals and scaling the team to meet evolving organizational needs.

Responsibilities

Leadership and Direction

• Report to the CIO/CISO and contribute to executive-level decision making on security matters.
• Provide strategic leadership over the information security function, including technical operations, GRC, and incident response.
• Supervise a growing team of security professionals, with responsibility for hiring, performance management, training, and development.
• Build and execute a multi-year information security roadmap aligned with business goals and evolving threat landscapes.

At The Operational And Company Level

• Collaborate with IT, Legal, HR, Marketing, Compliance, Product, and business units to implement practical, risk-based security controls and policies across the enterprise.
• Serve as a subject matter expert on cybersecurity, advising stakeholders across the enterprise.
• Communicate risk posture, security metrics and program maturity to executive leadership and governance bodies.

Do the Work

• Lead the design, implementation, and continuous improvement of secure enterprise architectures, ensuring protection of data, applications, and infrastructure.
• Oversee technical security operations, including endpoint security (EDR/XDR & MDM), vulnerability management, logging and detection (SIEM, SOAR, threat intelligence, UEBA, CSPM/ASM), data protection (DLP, classification, encryption, backup and governance), application and Dev Sec Ops  (SAST/DAST, SBOM, secrets, API and container security), and cloud/infrastructure security (CWPP, IaC scanning, and hybrid/cloud hardening).
• Develop and implement comprehensive GRC programs addressing risk management, compliance standards (e.g., NIST 800-171, CMMC, ISO, CIS), customer requirements, audit readiness, policy management, and vendor risk.
• Direct incident response, conduct root cause analysis, and implement corrective actions.
• Oversee business continuity and resilience initiatives such as DR automation, tabletop exercises, and cross-team crisis readiness.
• Establish and maintain security metrics, KPIs, and reporting processes.
• Develop and maintain the information security budget, ensuring strategic allocation of resources.
• Stay informed of emerging threats, technologies, and regulatory changes to continuously improve security posture.
• Support internal and external security audits and regulatory inquiries.
• Oversee development and delivery of training and awareness programs to promote a security-conscious workforce.

Success Metrics and Competencies

• Strong leadership presence with the ability to influence at all levels of the organization.
• Ability to effectively communicate with technical and non-technical…