Director, Cybersecurity

The Director of Cybersecurity is responsible for leading the organization's enterprise cybersecurity strategy, governance, and operations in a serverless cloud-first Microsoft 365 technology environment. This role will drive the centralization and standardization of the cybersecurity program, establish a scalable security operating model, and mature security capabilities across the enterprise. The Director will develop and execute a multi-year cybersecurity roadmap aligned with business objectives, M&A activity, NIST CSF 2.0, CIS Controls v8.1, and evolving risk landscapes to strengthen the organization's security posture and resilience.

The ideal candidate possesses deep Microsoft 365 enterprise expertise and understands how to maximize the value of both native Microsoft security capabilities and MSSPs to create a comprehensive, telemetry-driven cybersecurity program. This leader will optimize the collection, integration, and operationalization of security data across Microsoft 365, Entra ID, Defender, Intune, Purview, and third-party security platforms, ensuring MSSPs are strategically leveraged to enhance visibility, accelerate threat detection and response, and provide actionable insights that strengthen the organization's overall security posture.

The position will establish clearly defined roles, responsibilities, escalation paths, and accountability across internal teams and MSSP partners to ensure effective security operations, service delivery, continuous improvement, and organizational cybersecurity maturity.

The ideal candidate is a strategic leader who can define and execute a compelling cybersecurity vision while building and mentoring a high-performing cybersecurity team. This role is responsible for creating and advancing a mature, risk-based security program aligned with the NIST CSF 2.0 and CIS Controls v8.1, while developing and maintaining a collaborative operating model with MSSPs.

Essential Duties & Responsibilities

• Build and manage clear internal cybersecurity team roles, responsibilities, and operating processes aligned with strategic MSSP partnerships.
• Leverage deep Microsoft 365 Defender and Azure expertise to maximize security telemetry, visibility, and threat response through the strategic integration of Microsoft with third-party security platforms.
• Lead the development, maintenance, and continuous improvement of enterprise threat detection and incident response playbooks and runbooks, ensuring effective detection, containment, mitigation, remediation, recovery, and post-incident lessons learned activities across the organization.
• Lead enterprise cyber-attack preparedness and crisis readiness by aligning people, processes, technologies, and testing programs to minimize operational risk and business impact from cyber incidents.
• Develop, maintain, and operationalize enterprise incident response and crisis management programs, including response plans, tabletop exercises, recovery testing, and stakeholder communications, to ensure rapid containment, effective decision-making, and minimal business disruption during cyber incidents.
• Implement and optimize security awareness training programs, leveraging industry best practices and measurable performance metrics to reduce human risk and provide leadership with clear visibility into cybersecurity awareness, engagement, and risk mitigation effectiveness.
• Drive the continuous improvement of outsourced cybersecurity services by maturing security monitoring, threat detection and response, vulnerability management, cloud security, threat intelligence, and security validation programs to reduce risk and strengthen security posture.
• Own and optimize enterprise security monitoring and protection capabilities, including EDR, ITDR, MDR, SIEM, Vulnerability Management, and Cloud Posture.
• Oversee continuous threat exposure management through network vulnerability scanning, external penetration testing, and dark web scans.
• Cloud Apps: Maintain visibility and control over the organization's cloud application portfolio through continuous discovery, classification, risk evaluation, and security oversight.
• Oversee enterprise identity and access management by driving adoption of Entra ID SSO, SCIM-based automated provisioning, and centralized identity governance across connected applications.
• Oversee enterprise identity and access governance for both Entra-integrated and non-SSO applications, ensuring secure authentication, authorization, user lifecycle management, and periodic access reviews across all business systems.
• Develop, maintain, and annually update security policies and procedures while conducting regular tabletop exercises to validate incident response readiness, including DR, IR, and BC.
• Oversee the management and optimization of email firewalls, including DMARC policy.
• Oversee the management and optimization of network firewalls IDS/IPS.
• Provide monthly executive reporting.

Education & Experience

• Relevant education in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field is preferred; equivalent professional experience will be considered.
• 8+ years of progressive IT and cybersecurity experience.
• 3+ years in a cybersecurity leadership role.
• Experience leading cybersecurity transformation initiatives aligned to frameworks such as NIST CSF 2.0 and CIS Controls.

This job description should not be considered all-inclusive. It is merely a guide of expected duties. The employee understands that the job description is neither complete nor permanent and may be modified at any time. At the request of their supervisor, an employee may be asked to perform additional duties or take on additional responsibilities without notice. This is a safety-sensitive position and may be subject to additional compliance requirements.