We are seeking a hard-working, innovative, detail-oriented, and creative team player to join our Aptive team! This is a full-time Director, Cyber Securityposition located in Provo, Utah. This role defines the enterprise security strategy and program, builds and leads the security team, and is accountable for protecting customer data, payment systems, the corporate environment, and business-critical platforms—balancing strong security with the velocity a fast-growing business requires.

What we offer:

• $200k Annual Salary + Annual Bonus Potential of up to 20%

• Group Health, Dental, and Vision plans

• Pet insurance, Life insurance, and EAP benefits

• 401K with employer match up to 4%

• Paid holidays and paid time off

• Opportunity for advancement

• Upbeat and exciting company culture and much more!

Responsibilities include:

• Define and lead the enterprise information-security strategy, roadmap, policies, standards, and budget

• Build, lead, and develop the security team across security engineering, SecOps, and GRC

• Identify, quantify, prioritize, and drive remediation of enterprise security risk; report posture to executive leadership

• Protect payment and customer data; secure billing/payment systems, the data platform, and sensitive data flows across the SaaS/gateway ecosystem

• Own detection, monitoring, vulnerability management, and incident response; establish and exercise IR/breach plans

• Drive compliance with PCI DSS, SOC 2, and privacy regulations; own audits, evidence, and vendor/third-party risk

• Drive company-wide security awareness and shared responsibility

• Perform other related duties as assigned

Requirements:

• Bachelor's degree in Computer Science, Information Security, or related field, or equivalent experience

• 10+ years in information security, including 5+ years leading security teams and building or maturing a security program

• Broad, hands-on security expertise across security architecture, cloud security, application/API security, security operations, and identity & access management

• Deep experience protecting payment systems and sensitive customer data at scale, including PCI DSS obligations

• Command of security and privacy frameworks (PCI DSS, SOC 2, NIST/CIS) and privacy law (CCPA/CPRA and comparable state regimes)

• Proven ability to build or mature a security program and lead a security organization

• Incident-response leadership from detection through executive and regulatory communication

• Third-party/vendor risk and data-privacy program management