Job DescriptionIHG Hotels & Resorts is hiring a
Director of Information Security to lead cybersecurity strategy, security engineering, and enterprise information risk management for one of the world's leading hospitality companies. In this role, the senior security leadership will own threat detection, incident response, and security risk governance - turning complex cyber risk into clear, future-state security strategies and roadmaps that protect our guests, owners, and the trusted IHG brand.
As the Lead, you will set the standards for enterprise security controls and compliance, security policy management, and AI governance programs. You'll establish direction for regulatory compliance (PCI DSS, IT SOX, SOC 1, SOC 2, SWIFT), owns the security policy lifecycle, and establishes responsible AI guardrails. Drives executive accountability for control health with VPs and SVPs, represents the function in strategic governance forums (Financial Controls SteerCo, AI Responsible Use SteerCo, AI Working Group), and runs a blended onshore/offshore team through a manager-led model.
Your Day to Day- Own the information security strategy and cybersecurity roadmap for a global enterprise - covering threat detection, triage, analysis, containment, incident recovery, and executive reporting.
- Lead the enterprise information risk management program, ensuring IT assets are protected and that security risks are identified, assessed, and reported against compliance and regulatory requirements (PCI DSS, SOX, GDPR-aligned environments).
- Act as the executive subject matter expert on protective security, security intelligence, and crisis and threat management.
- Set and enforce security engineering standards across SIEM/intrusion detection, firewalls, vulnerability management, penetration testing, secure email, IAM (identity and access management), and network security.
- Direct complex cybersecurity programs and projects end to end - on scope, on schedule, and on budget.
- Partner with Global Technology and business leaders to embed security practices enterprise-wide and deliver board- and executive-level security reporting.
- Build and develop a high-performing security team of 7+ and lead third-party/vendor risk management, from selection and negotiation through long-term partnership.
What We Need from You - Bachelor's degree in Computer Science, Information Systems, Engineering, or Business - or equivalent experience. Security certifications (CISSP, CISM, CISA, CRISC) strongly preferred.
- 10+ years of progressive information security / cybersecurity experience, including 5+ years leading and structuring teams.
- Expertise in information security engineering, cyber risk management, and security risk management, with hands-on protective security implementation.
- Knowledge of crisis management, business continuity, and regional political, economic, crime, and security risk.
- Proven executive influence - able to persuade across all levels and manage escalations with senior stakeholders.
- Outstanding communication skills, translating complex technical risk into clear business language for executives and partners.
- Track record managing large-scale security programs from concept through implementation in a fast-changing, high-growth environment.
Travel - limited 10%
Location - Our
hybrid work structure is an expectation of
three (3) days a week in the ATLANTA office. This expectation may be adjusted with the changing needs of the business.
#LI-ZY1
