Director of Security and Compliance

Compensation Range: $200,000.00 - $225,000.00 Annual Salary

This position reports to the VP of IT Operations / Chief Information Security Officer.

About the Role

The Director of Security and Compliance leads the design and oversight of cybersecurity, compliance, and privacy programs that safeguard the organization’s digital assets and data while ensuring adherence to regulatory requirements, contractual obligations, and internal policies.

Responsibilities

• Risk Management: Sets the mission, vision, and strategy for technology risk management including cybersecurity, compliance, and privacy. Implements appropriate risk management and mitigation efforts while ensuring alignment with business objectives and product priorities.
• Communication & Executive Engagement: Demonstrates exceptional communication and presentation skills, effectively conveying complex technical and compliance concepts to critical stakeholders, including senior managers and the executive leadership team.
• Stakeholder & Relationship Management: Builds successful stakeholder relationships with IT, enterprise risk managers, and key business stakeholders by developing a clear understanding of business needs and acting as a trusted advisor.
• Security Architecture & Operations: Directs enterprise-wide security architecture and operations across IT and OT environments, ensuring secure design, deployment, and ongoing protection of infrastructure, applications, and data systems.
• Regulatory Compliance & Reporting: Ensures compliance with all relevant cybersecurity, compliance, and privacy regulations. Conducts compliance assessments and provides regular status reports to risk management teams and senior business leaders.
• Privacy Program Leadership: Leads a cross-functional Privacy Team to develop and implement a comprehensive enterprise-wide data and personnel privacy program. Maintains current policies and ensures all employees receive required privacy training.
• Budget & Financial Management: Develops and controls the annual department budget to ensure alignment with the overall strategic objectives of IT and the enterprise.
• Security Culture & Awareness: Fosters an enterprise security culture by embedding compliance and risk management practices into daily business operations. Leads organization-wide training and awareness initiatives.
• Risk Assessment, Business Continuity & Incident Response: Conducts comprehensive enterprise risk assessments and develops strategies that strengthen business continuity, disaster recovery, and incident response capabilities. Builds and coordinates cross-functional incident response teams.
• Data Retention & Archiving Compliance: Ensures digital and paper archiving systems comply with corporate data retention policies. Collaborates with Product Managers to align products and services with policies.
• Team Leadership & Development: Builds and leads a high-performing team. Supports direct reports' career progression, nurtures their development, and maintains a documented succession plan for critical functions.
• Vendor & Third-Party Management: Leads vendor management and negotiations with security service providers. Establishes strong vendor relationships to ensure alignment with security requirements.

Requirements

• Bachelor’s or Master’s degree in business administration or a technology-related field.
• 15 or more years of experience in IT Operations, cybersecurity, or business/industry.
• 7 or more years of leadership responsibilities, including strategy, budgeting, and staffing.
• 3 or more years of leadership responsibilities for an auditable compliance program (e.g., NIST 800-171, CMMC, ISO 2700x, SOC 2, NERC-CIP).

Skills

• Exceptional leadership skills, with the ability to develop and communicate a vision that inspires and motivates staff.
• Effective influencing and negotiation skills, with the ability to build consensus in complex environments.
• Strong collaboration skills across multiple teams, including business operating groups and corporate departments.
• Excellent analytical, strategic conceptual thinking, strategic planning, and execution skills.
• Strong business acumen, including industry and domain-specific knowledge of the enterprise and its business units.
• Experience developing staff, including coaching, mentoring, and performance management.
• Deep understanding of current and emerging security technologies and practices.
• Strong awareness of the current and changing regulatory landscape.
• Maintains awareness of emerging threats and incorporates appropriate mitigation measures.
• Demonstrated ability to develop and execute a strategic staffing plan.
• Third-party management experience, working closely with sourcing and vendor managers.

Preferred Qualifications

• Certified Information Systems Security Professional (CISSP).
• Certified Information Security Manager (CISM).
• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC) or other similar credentials.

Technology and Vendor Experience

• Required:
  • Security services - SaaS, on-premises, Managed Security Service Providers.
  • NIST 800-CSF, NIST 800-53.
  • Cloud & Network architecture.
  • Identity and access management.
  • Business continuity & disaster recovery.
  • Data management, classification, and privacy.
  • Artificial Intelligence.
  • Microsoft AWS.
• Optional:
  • Google.
  • Cisco.

Benefits

• Medical, dental, and vision insurance.
• 401(k) with company matching.
• Employee Stock Ownership Program (ESOP) and individual stock ownership.
• Paid vacation, sick leave, holidays, and bereavement leave.
• Employee assistance program.
• Pre-tax flexible spending accounts.
• Basic term life insurance and AD&D.
• Business travel accident insurance.
• Short and long-term disability.
• Financial wellness coaching.
• Educational assistance.
• Care.com membership.
• ClassPass fitness membership.
• DashPass delivery membership.
• Voluntary benefits, including:
  • Additional term life insurance.
  • Long-term care insurance.
  • Critical illness and accidental injury insurance.
  • Pet insurance.
  • Legal plan.
  • Identity theft protection.