Director, Information Security

Position Summary

The Director, Information Security is responsible for providing strategic leadership, governance, and operational oversight for the organization's Information Security programs. This role leads the development and execution of security strategies, policies, standards, and controls designed to protect enterprise systems, applications, data, and critical business operations from evolving cyber threats. The role combines strategic leadership with strong cybersecurity expertise and operational execution.

The ideal candidate is a proven cybersecurity leader with experience building high-performing teams, managing complex security programs, influencing executive stakeholders, and operating within highly regulated environments.

Key Responsibilities

Security Strategy & Leadership

• Develop, maintain, and execute the enterprise Information Security strategy, roadmap, and operating model.
• Align security initiatives with business objectives, risk management priorities, and regulatory requirements.
• Provide leadership across all Information Security functions, including security operations, threat management, vulnerability management, identity and access management, cloud security, application security, and security governance.
• Advise leadership on cybersecurity risks, emerging threats, and recommended mitigation strategies.
• Foster a security-first culture through awareness, education, and collaboration across the enterprise.
• Evaluate emerging technologies and cybersecurity trends to continuously improve organizational security capabilities.

Security Governance, Risk & Compliance

• Establish and maintain security policies, standards, procedures, and control frameworks.
• Ensure compliance with applicable regulatory, legal, and industry requirements.
• Lead security risk assessments and oversee remediation of identified risks and control gaps.
• Partner with Risk Management, Compliance, Legal, and Internal Audit teams to address audit findings and regulatory expectations.
• Provide oversight of security control effectiveness, risk reporting, and governance activities.
• Support regulatory examinations, independent assessments, and internal audits.

Security Operations & Threat Management

• Oversee Security Operations Center (SOC) activities and incident detection, response, and recovery capabilities.
• Ensure effective monitoring of security events, threats, vulnerabilities, and security incidents.
• Direct cyber incident response activities and executive communications during significant security events.
• Maintain threat intelligence, threat hunting, and security monitoring programs.
• Ensure operational security processes effectively reduce risk while maintaining business resiliency.
• Review security metrics, trends, and performance indicators to drive operational improvements.

Vulnerability & Cyber Risk Management

• Provide executive oversight of vulnerability management programs across infrastructure, cloud, applications, and third-party environments.
• Ensure timely identification, prioritization, remediation, and validation of security vulnerabilities.
• Establish risk-based methodologies for vulnerability prioritization and remediation.
• Monitor cybersecurity risk exposure and ensure business stakeholders understand associated risks.
• Review and approve remediation plans, exceptions, and compensating controls.

Identity & Access Management

• Ensure effective governance of user access, privileged access, authentication, and identity lifecycle management processes.
• Oversee implementation and operation of IAM, privileged access management (PAM), and identity governance (IGA) capabilities.
• Promote adoption of least privilege, multifactor authentication (MFA), and zero-trust security principles.
• Ensure access controls align with regulatory, audit, and security requirements.

Cloud & Application Security

• Provide strategic oversight for cloud security and secure application development practices.
• Ensure security requirements are integrated into technology architecture, cloud platforms, and software development lifecycles.
• Support DevSecOps adoption and secure-by-design engineering practices.
• Oversee security reviews of cloud services, applications, APIs, and third-party technologies.

Team Leadership & Talent Development

• Lead, mentor, and develop Information Security managers, engineers, analysts, and specialists.
• Establish organizational goals, performance expectations, and professional development plans.
• Build and maintain a high-performing, collaborative security organization.
• Manage staffing, succession planning, budget planning, and resource allocation.
• Promote accountability, continuous improvement, and technical excellence across security teams.

Executive Communication & Stakeholder Management

• Communicate cybersecurity risks, program status, and security initiatives to executive leadership and governance committees.
• Develop executive dashboards, metrics, and reporting that support informed decision-making.
• Translate technical risks into business impact and actionable recommendations.
• Partner with business leaders to balance security requirements with operational objectives.
• Represent the Information Security function in strategic planning, governance forums, and cross-functional initiatives.

Required Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field, or equivalent professional experience.
• 10+ years of progressive experience in cybersecurity, information security, technology risk, or related disciplines.
• 5+ years of leadership experience managing cybersecurity teams and security programs.
• Strong understanding of cybersecurity frameworks, risk management methodologies, and security operations.
• Experience leading enterprise security initiatives involving cloud technologies, identity management, vulnerability management, and security operations.
• Demonstrated experience developing and executing cybersecurity strategies and roadmaps.
• Experience presenting cybersecurity risks and recommendations to executive leadership and governance committees.
• Strong knowledge of security technologies, controls, and industry best practices.
• Excellent leadership, communication, stakeholder management, and decision-making skills.
• Must be legally authorized to work in the United States.

Physical Demands and Work Environment: The working environment is generally favorable. Lighting and temperature are adequate, and there are no hazardous or unpleasant conditions caused by noise, dust, etc. Work is generally performed within an office environment, with standard office equipment available. Travel may be required. Candidates will report to the office three days each week. Onsite work requirements may change at any time.

The anticipated annual salary range for NY-based candidates for this position is up to $185,000. Base salary and position level will be determined by the role, experience, skill set and location. For eligible positions, discretionary incentive compensation may be awarded contingent on personal and company performance. Our benefits program includes medical, dental, vision, life insurance, 401k plan with company contribution and company match, tuition reimbursement and more.