Position SummaryThe
Vice President, Information Security & Infrastructure is the enterprise executive responsible for defining and leading the company's global cybersecurity, technology infrastructure, cloud, end-user technology, and data protection strategy. This leader establishes the vision, operating model, architecture, policies, standards, and governance needed to protect company information assets while delivering secure, reliable, scalable, and cost-effective technology services that enable business growth, operations, and innovation.
The VP will lead security across Hayward's entire technology ecosystem, including Operational Technology (OT), Industrial Control Systems (ICS), IoT, manufacturing environments, and connected products, driving a unified approach to cyber risk, resilience, and security governance.
This leader advises executive leadership and the Board of Directors on the company's cyber risk, posture and resilience; leads enterprise-wide security controls, threat protection, identity and access management, security awareness, vendor risk, incident preparedness, disaster recovery, and business continuity; ensures the organization can demonstrate compliance with applicable regulations, public-company controls, and recognized industry standards; and drivers infrastructure, cloud services, network services, and end-user computing and support.
The role is accountable for the security, availability, performance, and operational effectiveness of Hayward's technology environment and end-user experience.
Responsibilities:Enterprise Security Strategy & Executive Leadership- Define and execute the global information security strategy, multi-year roadmap, operating model, and investment priorities aligned with business goals and risk appetite.
- Serve as the senior enterprise advisor on cybersecurity risk, presenting clear recommendations, performance indicators, emerging threats, and material exposures to executive leadership and the Board of Directors.
- Integrate security into enterprise technology strategy, digital products, business transformation, mergers and acquisitions, and global operations.
- Balance risk mitigation with innovation, customer experience, operational effectiveness, and competitive advantage.
- Establish enterprise accountability, decision rights, and governance forums for cybersecurity and information risk.
Security Architecture, Engineering & Operations- Lead the development of technical security architecture specifications, standards, and patterns across business environments, infrastructure, cloud, web, application, and digital platforms.
- Oversee global capabilities for security monitoring, threat detection, vulnerability management, penetration testing, endpoint and network protection, security event correlation, and incident response.
- Ensure the confidentiality, integrity, and availability of information assets through effective preventive, detective, and corrective controls.
- Drive secure-by-design practices across technology delivery, software development, infrastructure, and product development.
- Guide evaluation and implementation of security technologies, including firewalls, VPN, Security Information and Event Management platforms, identity solutions, and cloud security controls.
Cyber Risk, Governance & Compliance- Build and lead an enterprise information security assurance program with annual and long-term goals, risk strategies, governance processes, metrics, and reporting mechanisms.
- Own the strategy for security audits, compliance reviews, and external assessments, including Sarbanes-Oxley controls, General Data Protection Regulation, California Consumer Privacy Act, and other applicable requirements.
- Oversee security policies, standards, procedures, control frameworks, exception management, and remediation governance.
- Lead enterprise cybersecurity risk assessments and ensure material risks are communicated to the appropriate executive, business, and Board audiences.
- Align the security program with recognized frameworks such as NIST, ISO 2700x, ITIL, COBIT, and relevant network defense methodologies.
Incident Preparedness, Resilience & Business Continuity- Provide executive oversight of cybersecurity incident preparedness, response, escalation, crisis communications, recovery, and post-incident improvement.
- Lead the enterprise approach to disaster recovery and business continuity for critical processes and systems.
- Ensure Recovery Point Objectives and Recovery Time Objectives are defined, tested, achievable, and aligned with business requirements.
- Drive scenario planning, tabletop exercises, recovery testing, and coordinated response practices across technology and business functions.
- Ensure resilience investments are prioritized based on criticality, business impact, and enterprise risk.
Identity, Access & Data Protection- Define and lead the enterprise Identity and Access Management strategy with emphasis on scalability, resilience, appropriate access, and strong end-user experience.
- Oversee privileged access, authentication, authorization, access governance, and lifecycle controls.
- Partner with Legal, Privacy, Internal Audit, Technology, and business leaders to protect sensitive data and support applicable privacy obligations.
- Ensure external access, data movement, and critical information assets are governed by appropriate controls and monitoring.
Security Awareness & Culture- Champion a global security culture in which employees understand and act on their responsibility to protect company information and systems.
- Direct an enterprise security awareness program addressing phishing, social engineering, acceptable use, policy expectations, and emerging threats.
- Use metrics, simulations, and risk trends to improve program effectiveness and reduce human-related security exposure.
- Engage senior leaders to reinforce security accountability within their functions and teams.
Third-Party & Vendor Risk Management- Provide executive ownership of the company's information security vendor risk management program.
- Ensure initial and periodic risk assessments address information security standards, service-level commitments, recovery expectations, and policy compliance.
- Oversee security expectations for third parties, staff augmentation providers, strategic technology partners, and externally hosted services.
- Partner with Procurement, Legal, Finance, Internal Audit, and business leaders on risk-based vendor decisions and remediation.
Financial Stewardship & Business Management- Develop and manage information security capital and operating budgets, forecasts, business cases, and investment roadmaps.
- Prioritize investments based on enterprise risk reduction, regulatory obligations, business enablement, and operational resilience.
- Negotiate and administer strategic security service agreements and vendor contracts.
- Establish executive dashboards that demonstrate performance, control effectiveness, risk reduction, investment outcomes, and program maturity.
Global Infrastructure & Cloud Services- Define and execute the global infrastructure and cloud strategy, architecture, standards, roadmaps, and investment priorities.
- Lead secure, reliable, and scalable on-premises, cloud, network, compute, storage, and core infrastructure services.
- Drive infrastructure modernization, cloud adoption, lifecycle management, automation, standardization, and technical debt reduction.
- Establish performance, availability, capacity, resilience, and service-level expectations for critical infrastructure platforms.
- Optimize infrastructure cost, performance, and vendor partnerships while ensuring alignment with enterprise architecture, cybersecurity, and business requirements.
End-User Technology & Support- Define and lead the global end-user technology and support strategy, ensuring a consistent, secure, and productive employee technology experience.
- Oversee workplace technology services, including end-user devices, collaboration tools, software distribution, mobility, service desk, and field/site support.
- Establish service-management standards, SLAs, performance metrics, and continuous improvement practices across end-user support.
- Drive device and workplace technology standardization, lifecycle management, automation, and self-service capabilities.
- Partner with business and technology leaders to improve employee experience, service quality, support effectiveness, and technology adoption.
Organization & Talent Leadership- Build and lead a high-performing global information security organization that protects company assets while preserving innovation, agility, and competitive advantage.
- Lead internal security personnel and technical resources, including third-party, vendor, and staff augmentation relationships.
- Develop the leadership team, succession pipeline, operating capabilities, and technical depth of the function.
- Establish clear performance expectations and foster collaboration, accountability, inclusion, continuous learning, and sound risk judgment.
Qualifications:Education- Bachelor's degree in Computer Science, Information Systems, Engineering, Business, or a related field required.
- Master's degree in Technology, Business Administration, or a related discipline preferred.
Experience- 15+ years of progressive information security, cybersecurity, technology risk, compliance, or related experience, including substantial leadership responsibility in complex, global environments.
- 10+ years leading people, leaders, and multidisciplinary security teams; experience building and scaling a high-performing information security organization.
- Demonstrated success managing cyber risk, compliance, and resilience for a public company or comparably regulated enterprise.
- Experience advising executive leadership and presenting complex cyber risk matters to Boards of Directors or Board committees.
- Experience developing and managing significant operating and capital budgets, strategic vendors, and enterprise security investments.
Preferred Certifications- Certified Information Systems Security Professional (CISSP).
- Certified Information Security Manager (CISM).
- Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or equivalent credentials.
#LI-KF1
