Director, Global Information Security

Own and advance information security across a globally distributed humanitarian organization operating in high-risk environments. Build and mature the information security program, deepen partnerships, and foster a cybersecurity culture to keep Americares safe, resilient, and trusted. With a technology footprint spanning country offices, a growing cloud and SaaS environment, and expanding donor, partner, and beneficiary data obligations, this role provides dedicated, expert ownership of information security to operate responsibly at scale.

Responsibilities

• Own and advance Americares’ global information security program, including policy development, governance frameworks, security standards, and cybersecurity culture across HQ and country office operations worldwide.
• Lead and oversee all managed security services and vendor relationships, including MDR/SOC provider performance, endpoint protection, email security, CIS membership and assessments, and cyber insurance compliance, ensuring vendors are held accountable to clear standards and delivering measurable value.
• Conduct and manage CIS-based security assessments, produce prioritized risk registers and remediation roadmaps, oversee vulnerability management including risk ranking, remediation tracking, and exception handling, and report progress against the security roadmap to leadership.
• Own the cybersecurity incident response plan, including maintenance, tabletop exercises, staff training, and active coordination with internal teams (Legal, Compliance and Risk Management, Finance, Communications, and country offices) during incidents, ensuring alignment with broader crisis management and business continuity processes.
• Partner with Technology Operations, Data Management and Enterprise Applications, Legal Compliance and Risk Management, and Global Safety and Security to define, validate, and maintain security requirements across infrastructure, applications, identity, data, and physical security.
• Oversee day-to-day security operations including SOC/MDR ticket review, escalation management, service quality oversight, identity and access control validation, and correlation of signals across endpoint, email, cloud, and network environments.
• Represent Americares in peer security communities including NetHope and NGO-ISAC, serve as the internal subject matter expert on cybersecurity for leadership, and build a security-aware culture across a globally distributed workforce through awareness programs, policy socialization, and change management.
• Actively model and contribute to Americares values, work culture, and mission.
• Engage in and contribute to team spaces with openness, global competencies, and a growth mindset.
• Other duties and responsibilities as assigned.

First 90 Days

• Learn and live the Americares values.
• Complete all required new hire onboarding trainings.
• Demonstrate an understanding of Americares programmatic work and business models.
• Review IT policies and relevant vendor agreements.
• Develop a deep understanding of the information security posture.
• Document an initial understanding of Americares cybersecurity architecture, including the current state of endpoint protection, identity and access management, email security, cloud security, and SOC/MDR coverage, and identify immediate gaps requiring attention.
• Begin to develop strong relationships with critical stakeholders, including Technology Operations, Legal, Compliance and Risk Management, Global Safety and Security, Data Management & Enterprise Applications team, country office leadership, and external vendors and suppliers.
• Establish a regular reporting cadence with the VP, Information Technology on security posture, active risks, and priority actions.
• In close partnership with the Technology Operations team, LCRM, country office management teams, and other relevant stakeholders, lead the review of the results from externally conducted CIS assessment and develop a prioritized risk register, recommended remediation roadmap, mitigation strategies, and a briefing for leadership.

First 6 Months

• Develop a long-term global information security strategy and roadmap that aligns with Americares strategic objectives over the next 5 years.
• Socialize and garner necessary buy-in and support for the roadmap across the organization.
• Identify and plan for necessary resources for the roadmap in FY28.
• Own the cybersecurity Incident Plan, making updates as needed, and train relevant stakeholders.
• Ensure the cybersecurity Incident Plan is coordinated with the organization's crisis management and business continuity processes so the incident plan reflects operational continuity beyond the technical response.

First Year

• Complete Phase I of the information security roadmap.
• Achieve significant organization-wide understanding and adoption of IT policies and security SOPs through socialization and change management.
• Demonstrate improvement in CIS assessment scores based on positive impact from the cybersecurity roadmap.

Requirements

• CISM, CISSP, CySA+, Security+, or Microsoft security certifications such as SC-200 or SC-300.
• US work authorization without restriction and willingness to travel up to 10%.
• Candidates must be currently living in and will continue to live in one of the following states/territories: CT, DC, FL, GA, IL, MD, MA, NC, NJ, NY, OR, PA, Puerto Rico, TN, TX, VA, or WA.

Skills

• Influence and Functional Authority: Achieves security outcomes through people and teams who do not report to them. Builds credibility with peers in Infrastructure, Data Management, Enterprise Applications, Legal, and country operations. Sets clear expectations and holds others accountable through relationship and expertise rather than positional authority. Knows when to escalate to the VP and when to resolve laterally.
• Security Judgment and Risk Communication: Translates complex and evolving cybersecurity risks into clear, actionable language for non-technical audiences including leadership, Legal, country directors, and program staff. Makes sound risk prioritization decisions under uncertainty and resource constraints. Knows what to escalate, what to absorb, and what to defer.
• Program Building in a Resource-Constrained Environment: Has built or materially advanced a security program without a large team or budget. Comfortable doing hands-on work while simultaneously designing the governance structures, policies, and processes that others will eventually operate. Does not wait for perfect conditions. Understands security and data-protection considerations for AI-enabled tools and platforms; partners with the organization's AI governance effort to define security guardrails and requirements for AI tool adoption.
• Vendor and Partner Oversight: Manages external security relationships (MDR, SOC, CIS, insurance company, consultants) with discipline. Knows what to expect from a managed service provider, how to hold them accountable, and when their output is insufficient. Has experience selecting and onboarding security vendors. Demonstrates a high degree of professionalism and finesse when working with a wide range of partner organizations who receive resources/funding on information security matters.
• Global and Cross-Cultural Awareness: Has worked in or alongside organizations operating in multiple geographies, ideally in development, humanitarian, or health contexts. Understands that security controls that work at HQ may need to be adapted for low-bandwidth, high-risk, or resource-limited country office environments, as well as high-risk, politically sensitive, and emergency response operating environments, where practical implementation of security controls often requires additional flexibility.
• Ownership and Resilience: Drives their focus area independently. Anticipates challenges, proposes solutions, and does not wait to be told what to do next. Approaches novel threats and organizational constraints with a growth mindset, modeling adaptability for the teams and partners they work with. Comfortable operating in ambiguity, especially during the program-building phase where not everything is defined yet.
• Communication and Stakeholder Engagement: Communicates security posture, risks, and recommendations clearly to diverse audiences, including preparing board-level materials in partnership with the VP of IT; engages directly with senior stakeholders as needed. Facilitates alignment among stakeholders with competing priorities. Engages country office and department stakeholders in ways that build buy-in rather than resistance. Can represent Americares in peer communities like NetHope and NGO-ISAC.

Preferred Qualifications

• Fluency in languages spoken in at least one of Americares core locations (India, Philippines, Tanzania, El Salvador, Puerto Rico, Colombia, etc.), in addition to English.

Americares core organizational competencies include: ownership and results, communication, problem solving, equity and inclusion, teamwork and conflict resolution, leadership, prioritization, management, strategy and planning, and decision making.