Director of Information Security (CISO)

About the Role

VulcanForms is seeking a Director of Information Security (CISO) to build and lead our information security program as we scale our digital manufacturing infrastructure for aerospace, defense, and medical customers. Reporting to the VP of IT, you’ll establish the strategy, policies, and controls that protect our intellectual property, production systems, and customer data, while enabling the business to move fast. This is a hands-on, founding role: you’ll build the security function from the ground up, standing up governance frameworks, hiring and developing a team over time, and partnering closely with IT, engineering, manufacturing, and legal to embed security into how VulcanForms designs, builds, and ships. Given our work with defense and aerospace customers, you’ll also own our compliance posture against frameworks like CMMC, NIST 800-171, and ITAR/EAR, making sure certification and audit readiness keep pace with our growth.

Location: Devens, MA.

Responsibilities

• Build and lead VulcanForms’ information security program from the ground up, defining strategy, roadmap, and governance as the company scales.
• Own compliance and certification efforts for CMMC, NIST 800-171, and ITAR/EAR, partnering with legal, contracts, and program teams to meet customer and government requirements across our defense and aerospace work.
• Design and implement security policies, standards, and controls covering IT infrastructure, cloud environments, OT/manufacturing systems, and endpoints.
• Lead risk assessments and manage a prioritized remediation roadmap, balancing security rigor with the pace of a scaling manufacturing operation.
• Establish incident response, business continuity, and disaster recovery plans, and lead the organization’s response to security incidents when they occur.
• Partner with IT, software, and manufacturing engineering teams to secure production systems, industrial control systems, and the software that runs our printers and factories.
• Manage security tooling and vendor relationships, including SIEM, endpoint detection, identity and access management, and vulnerability management platforms.
• Build and mature security awareness training and insider-risk programs across the organization.
• Recruit, hire, and develop a security team as