Overview: The Director of Information Security leads Fun Town RV's information security program. This role sets security strategy, policies and standards, manages risk and compliance, and leads the response to security incidents. The Director partners with the Information Systems team, which implements and maintains the company's technology.
Essential Duties and Responsibilities- Build, maintain and continuously improve the company's information security program, and report on its status to executive leadership at least annually.
- Develop, maintain and enforce information security policies, standards and procedures, including acceptable use, access control, data protection, logging and monitoring, and vendor risk management.
- Conduct periodic risk assessments and oversee the remediation of identified risks.
- Manage the vulnerability management program, including regular vulnerability assessments, annual penetration testing and remediation tracking.
- Maintain the incident response plan, lead the response to security incidents, and coordinate required notifications to regulators, customers and partners.
- Work with legal and compliance to identify applicable regulatory and industry requirements, and implement the IT and information security programs, policies, procedures and controls needed to meet them.
- Support legal, compliance and other departments on related programs, such as customer privacy and identity theft prevention.
- Work with the payment processor and Accounting to confirm that card payment processing meets payment card security requirements (PCI DSS), and maintain any requirements that apply to the company.
- Assess and monitor the security of third-party vendors that handle company or customer data.
- Set access management standards, including least-privilege access, multi-factor authentication and periodic access reviews.
- Define data protection standards, including encryption, data classification, data loss prevention (DLP), retention and secure disposal.
- Define security requirements and configuration standards for the Microsoft cloud environment, and verify they are met.
- Lead business continuity and disaster recovery planning and testing.
- Develop and deliver security awareness training for all employees, including internal phishing simulation testing.
- Manage cyber insurance requirements and prepare the company for audits and assessments.
- Partner with IT leadership to design and improve IT service management processes, and review changes for security impact.
- Define logging and monitoring requirements, monitor security alerts and metrics, and provide regular status reports to the CIO.
Required Qualifications- Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Systems or a related field, or equivalent work experience.
- 8+ years of experience in information technology or information security, including at least 5 years in an infrastructure + security role combination.
- Experience building or managing an information security program, including policies, risk assessments and incident response.
- Hands-on experience securing Microsoft 365 and Microsoft Entra ID environments.
- Working knowledge of security regulations and frameworks such as PCI DSS, NIST Cybersecurity Framework or CIS Controls.
- Experience with Microsoft Intune, Microsoft Defender and Microsoft Purview.
- Experience managing vendor risk and working with cyber insurance carriers or auditors.
- Familiarity with ITIL-based IT service management.
Preferred Qualifications- Experience in automotive or RV retail, financial services, or another business that handles consumer financing data.
- Certifications (Optional, Not Required)
- CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager).
- Microsoft Certified: Cybersecurity Architect Expert (SC-100) or Security Operations Analyst (SC-200).
- CompTIA Security+.
- ITIL 4 Foundation.
Knowledge, Skills and Abilities- Strong understanding of identity and access management, network security, endpoint security, encryption and logging.
- Ability to translate security requirements into clear standards that IT teams can implement.
- Ability to assess risk and explain it in business terms to executives and non-technical staff.
- Strong written communication, including policies, reports and incident documentation.
- Sound judgment and composure when leading the response to security incidents.
- Ability to work across departments and with outside vendors, auditors and legal counsel.
Work Environment- This is a full-time, on-site position at the Fort Worth, Texas corporate office.
- Occasional travel to dealership locations.
- Availability outside normal business hours to respond to security incidents.
Benefits- Competitive salary based on experience.
- Health, dental, and vision insurance.
- Christmas Savings Plan.
- 401(k) with company match.
- Paid time off and holidays.
