The Senior Director of Security Configuration Management & Cyber Governance is a strategic cybersecurity leader responsible forestablishing, governing, and continuously improving enterprise-wide security configuration management, cyber governance, compliance, and risk oversight programs. This role ensures the organization's technology assets, platforms, and services are securely configured, governed according to industry best practices, and aligned with regulatory, business, and risk managementobjectives.

The Senior Director will lead multidisciplinary teams responsible for security baselines, configuration standards, governance frameworks, policy management, compliance oversight, control effectiveness, and cyber risk reporting. This leader serves as a trusted advisor to executive leadership, technology organizations, audit partners, regulators, and business stakeholders to strengthen the organization's cybersecurity posture while enabling business transformation and innovation.

Key Responsibilities

StrategicInformation SecurityLeadership & Governance

• Develop and execute the enterprise strategy for security configuration management and cyber governance.

• Provide executive-level reporting on cyber risk, control effectiveness, compliance posture, and configuration management maturityaligned withriskappetite

• Partner with business, technology, risk, legal, compliance, and audit stakeholders to ensure consistent governance practices acrosstheInformationSecurity organization.

• Drive continuous improvement initiatives that enhance operational resilience, security effectiveness, and regulatory readiness.

• Monitor emerging cyber threats, vulnerabilities, and industry trends to proactively address risks.

Security Configuration Management

• Establish enterprise security configuration standards, baselines, and hardening requirements acrossCloud, SaaSand OnPremsoftwareservices.

• Ensure secure configuration controls are integrated into system development, deployment, and operational processes.

• Oversee configuration compliance monitoring,riskprioritization, remediationgovernanceandexecutive reporting.

• Lead initiatives to automate configuration management, compliance validation, and securityconfigurationenforcement.

• Define key performance indicators (KPIs), key risk indicators (KRIs), and metrics to measuresecurityconfiguration compliance and risk reduction outcomes.

• Ensure alignment with industry frameworks such as NIST, CISBenchmarksand relevant regulatory requirements.

• Drive continuous improvement of configuration compliance, and security control effectiveness.

• Ensuretimelyremediation of security misconfigurationsacross the enterprise

• Lead securityconfigurationmanagementassessments and audits conducted by internalaudit, regulators, and external parties.Ensure effective remediation of audit findings and regulatory observations.

Cyber Governance

• Lead cyberassurancegovernance program,partnering with InformationSecurity Standard owners todefinekey requirements andmonitors

• Lead development of governance dashboards, scorecards, and metrics that provide transparency into control performance, compliance posture, risk trends, and remediation progress.

• Present cybersecurity risks, trends, and remediation status to executive leadership, risk committees, and governance forums.

• Monitor emerging cybersecurity threats, regulatory developments, and industry trends to proactively evolve governance practices.

• Ensure alignment with enterprise risk management frameworks and regulatory expectations.

Leadership & People Management

• Build, lead, mentor, and develop high-performing teams focused on security governance,securityconfiguration management, and cyber risk oversight.

• Foster a culture of accountability, innovation, collaboration, and continuous learning.

• Establish clear goals, performance expectations, and development plans for leaders and team members.

• Drive workforce planning, succession planning, talent acquisition, and leadership development initiatives.

• Manage budgets, vendor relationships, and strategic initiatives.

• Influence and inspire cross-functional teams without direct authority to achieve strategic cybersecurityobjectives.

• Promote strong partnerships across technology, security operations, engineering, architecture, risk, compliance, and business functions.

• Serve as a key cybersecurity representative to executive leadership committees and governance forums.

• Communicate complex technical and risk topics in clear business termsappropriate forexecutive and board-level audiences.

• Build strong relationships with regulators, auditors, industry peers, and external partners.

• Influence strategic technology decisions through cybersecurity governance and risk managementexpertise.

Minimum Required Experiences

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field.

• 8 years of progressive experience in cybersecurity, information security, risk management, governance, or technology leadership roles.

• 8+ years of leadership experience managing large teams and senior-level managers.

• Demonstrated experience leading enterprise-scale security configuration management, cyber governance, risk, compliance, or security engineering programs.

• Deep understanding of cybersecurity frameworks, standards, and regulations including NIST CSF, NIST 800-53, CIS Controls, ISO 27001, COBIT, and relevant regulatory requirements.

• Deepknowledge of cloud security, infrastructure security, endpoint security,security configurationmanagement, and security operations.

• Experience presenting cybersecurity strategies, risks, and performance metrics to executive leadershipandexecutive committees

• Proven ability to lead organizational change and driveadoptionof enterprise security initiatives.

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Risk Management, or relatedfield.

• Strong understanding of regulatory requirements applicable to financial services or highly regulated industries.

• Shows curiosity and adaptability in learning and responsibly applyingnew technologies, including artificial intelligence, to reimagine how wework.

Desired Experiences

• Master's degree in Cybersecurity, Information Security, Business Administration, or related discipline.

• Industry certifications such as CISSP, CISM, CRISC, CGEIT, CISA, or equivalent.

• Experience within highly regulated industries such as financial services, government, healthcare, or critical infrastructure.

• Experience implementing governance and securityconfigurationsandcontrolsacross hybrid cloud and modern technology environments.

• Knowledge ofDevSecOps, Infrastructure as Code (IaC), automated compliance monitoring, and security orchestration technologies.

Leadership Competencies

• Strategic Thinking and Vision

• Executive Presence and Influence

• Risk-Based Decision Making

• Talent Development and Coaching

• Organizational Leadership

• Change Management

• Cross-Functional Collaboration

• Operational Excellence

• Accoun