Sr. Director, Cybersecurity

We need to output HTML fragment with sections: About the role? Actually we need to use headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must only include sections when posting has real specific content. The posting includes Job Summary (could be About the role). It includes Associate Responsibilities (Responsibilities). It includes Required Education (Qualifications). It includes Required Skills & Experience (Skills). It does not mention Benefits, Pay, Schedule. So we should not include those sections. Also we should not repeat job title as heading. Also we should not include Job ID etc. We need to preserve all substantive information. Remove boilerplate like EEO etc. Also remove "Inspired by Hard Work At Carhartt..." maybe that's fluff but it's part of posting; it's not boilerplate? It's values statement; maybe we keep? The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The values statement is not boilerplate but could be considered fluff; but it's substantive? It's about company values; maybe we can keep as part of About the role? It's not directly about role. Might be considered filler but not prohibited. Safer to keep it as part of About the role? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." The values statement is substantive? It's about company culture; could be considered part of job posting. I'd keep it as a paragraph under About the role. We need to format: Use

for section headings. Use

• for any list of duties/requirements/benefits, and

  for prose. We need to decide what constitutes a list. The responsibilities are many bullet-like sentences each starting with a verb. Could format as

  • each sentence. Similarly for Required Skills & Experience bullet points. We need to include Required Education as maybe a

    or list? It's prose; we can put as

    . We need to avoid headings with no content. Thus sections:

    About the role

    containing Job Summary paragraph plus maybe the values statement.

    Responsibilities

    containing
    with each responsibility sentence.

    Qualifications

    containing Required Education paragraph.

    Skills

    containing Required Skills & Experience paragraph(s) maybe as
    list. We must not include Benefits, Pay, Schedule. We need to ensure we don't duplicate lines. Let's extract responsibilities sentences from "Associate Responsibilities" block. They are many sentences separated by periods. We'll split each sentence that ends with a period. Need to keep each as
    • . Ensure we keep the content exactly. Let's copy the responsibilities text: "Own and execute a multi-year enterprise cybersecurity strategy and roadmap aligned with business priorities, risk appetite, technology strategy, and regulatory obligations.Lead, coach, and develop leaders and teams across the four cybersecurity functions; establish clear decision rights, succession plans, talent pipelines, operating rhythms, and measurable performance expectations.Advise executive leadership on material cyber risks, emerging threats, major incidents, strategic tradeoffs, and investment needs using clear business and financial context.Own the cybersecurity operating model, annual planning, budget, workforce strategy, sourcing model, vendor portfolio, and prioritization of capabilities and initiatives.Establish program-level objectives, key risk indicators, key performance indicators, maturity targets, and executive reporting that demonstrate risk reduction and operational outcomes.Build strong partnerships across Information Technology, Enterprise Risk, Legal, Privacy, Internal Audit, Compliance, Human Resources, Finance, Supply Chain, and business functions.Define and maintain the enterprise cybersecurity strategy, target-state capabilities, policy architecture, control framework, and prioritized roadmap.Provide strategic direction for enterprise security architecture and security-by-design practices across cloud, on-premise, applications, infrastructure, data, and third-party services.Present cyber risk posture, incidents, trends, program performance, and investment recommendations to senior leadership and appropriate governance bodies.Lead annual and long-range planning, including budget development, capital and operating forecasts, resource allocation, sourcing decisions, and benefits realization.Oversee major cybersecurity transformation initiatives and ensure dependencies, risks, milestones, and outcomes are actively managed.Maintain external awareness of threat, regulatory, technology, and industry developments; translate relevant changes into program priorities.Establish a threat-informed operating model with clear severity criteria, escalation paths, service levels, playbooks, evidence requirements, and communication protocols.Direct response to significant cybersecurity incidents, coordinating containment, eradication, recovery, executive communications, legal and privacy engagement, and lessons learned.Sponsor exercises and simulations that validate incident response, crisis management, business continuity dependencies, and executive decision-making.Lead cybersecurity governance, policy and standards, risk assessment, compliance, control assurance, third-party cyber risk, awareness, exception management, and audit coordination.Maintain an enterprise cyber risk taxonomy and consistent methods for identifying, assessing, documenting, treating, accepting, monitoring, and escalating cyber risks.Oversee compliance with applicable legal, regulatory, contractual, and industry requirements and align the control environment to recognized cybersecurity frameworks.Coordinate independent assessments, audits, remediation plans, risk acceptances, and evidence quality; ensure accountable owners and sustainable closure of findings.Drive role-based cybersecurity awareness and behavior-change programs in partnership with business and enabling functions.Partner with the enterprise risk function to integrate cyber risk into the enterprise risk management framework, governance cadence, risk register, and executive reporting.Translate technical findings and threat conditions into business risk scenarios that describe affected objectives, plausible impacts, likelihood considerations, control effectiveness, dependencies, and treatment options.Calibrate cyber risk ratings and escalation thresholds with enterprise risk criteria so cyber risks can be consistently compared, aggregated, and prioritized alongside other enterprise risks.Provide timely inputs for enterprise risk assessments and reporting, including material changes in exposure, emerging risks, concentration risks, systemic dependencies, remediation commitments, and accepted residual risk.Facilitate risk ownership decisions with business and technology executives and ensure material risk acceptance is documented at the appropriate level of authority.Collaborate on risk appetite and tolerance statements, scenario analysis, executive exercises, and risk-informed investment planning.Set clear objectives and conduct regular operating reviews across services, incidents, risks, controls, projects, vendors, budgets, and talent.Oversee strategic vendors, managed services, consultants, and technology partners, including service quality, contractual performance, concentration risk, and value realization.Define and test continuity plans for critical cybersecurity services and leadership coverage.Represent the cybersecurity function in enterprise planning, major technology decisions, and other strategic initiatives as needed." We need to split at periods. Some sentences have semicolons inside; that's fine. We'll create
    • for each sentence. Now Required Education paragraph: "Bachelor's degree in Computer Science, Information Systems, Cybersecurity, Engineering, Business, Risk Management, or a related field, or equivalent combination of education and relevant experience. Master's degree in Cybersecurity, Information Systems, Business Administration, Risk Management, or a related discipline preferred. One or more relevant professional certifications preferred, such as CISSP, CISM, CISA, CRISC, CGEIT, or comparable security, risk, audit, cloud, or architecture credentials." We can keep as

      with sentences. Now Required Skills & Experience block: "Minimum of 15 years of progressively responsible experience across cybersecurity, information technology, technology risk, or related disciplines. Minimum of 8 years of people leadership experience, including leadership of managers or multiple cybersecurity functions in a complex enterprise environment. Demonstrated experience leading or providing executive oversight across Security Engineering, Security Operations, Identity and Access Management, and GRC. Proven success developing and executing enterprise cybersecurity strategies, roadmaps, operating models, and multi-year transformation programs. Experience advising senior executives and governance bodies on cyber risk, incident response, program performance, and investment priorities. Experience integrating cyber risk reporting with enterprise risk management, including risk taxonomy, scenario development, aggregation, appetite or tolerance, escalation, and executive reporting. Deep working knowledge of recognized cybersecurity and technology governance frameworks, such as NIST, ISO/IEC 27001, COBIT, CIS Controls, and ITIL. Demonstrated experience with security architecture, cloud and infrastructure security, security operations, incident response, vulnerability management, threat intelligence, IAM, third-party risk, compliance, audit, privacy, and resilience concepts. Experience managing substantial operating and capital budgets, strategic suppliers, managed services, and cross-functional portfolios. Exceptional business acumen, executive presence, written communication, presentation, negotiation, and influence skills. Ability to convert complex technical issues into concise business risk narratives and actionable decisions. Demonstrated ability to lead through ambiguity, manage competing priorities, build consensus, and drive accountable execution in a fast-paced environment." We can split into

    • each sentence. Now About the role: Job Summary paragraph plus maybe the values statement. Job Summary: "The Senior Director of Cybersecurity is the enterprise leader accountable for the strategy, governance, operational effectiveness, and continual maturation of the cybersecurity program. The role leads four integrated capabilities: Security Engineering, Security Operations, Identity and Access Management, and Governance, Risk, and Compliance. This leader protects the confidentiality, integrity, and availability of information assets while enabling business objectives through risk-informed decision-making, resilient security architecture, effective operations, and clear accountability. The position partners closely with the enterprise risk function to translate cyber threats, control gaps, and technology dependencies into business-oriented risk statements, scenarios, and reporting that can be aggregated into the overall enterprise risk program. The role regularly advises senior executives and business leaders, establishes investment priorities, and provides concise reporting on cyber risk exposure, program performance, resilience, and remediation progress." Then values statement: "Inspired by Hard Work At Carhartt, the values of hard work—dependability, honesty, and trust—are rooted in the legacy of our founder, Hamilton Carhartt. His commitment to serving hardworking people continues to inspire everything we do. Guided by his legacy and our mission—We serve and protect all hardworking people by building durable products—we remain dedicated to upholding these principles in every decision we make and every product we create." We can combine into one

      or separate

      s. Probably separate paragraphs. Now we need to output only HTML fragment, no /, no markdown. Let's craft. We'll have:

      About the role

      Job Summary text

      Values statement text

      Responsibilities

      • ... each sentence ...
      ...

      Qualifications

      Required Education text

      Skills

      • ... each sentence ...
      ...
      Make sure to preserve punctuation exactly. Now we need to split responsibilities into sentences. Let's do that manually. I'll copy the responsibilities block and split. I'll write each sentence: 1. Own and execute a multi-year enterprise cybersecurity strategy and roadmap aligned with business priorities, risk appetite, technology strategy, and regulatory obligations. 2. Lead, coach, and develop leaders and teams across the four cybersecurity functions; establish clear decision rights, succession plans, talent pipelines, operating rhythms, and measurable performance expectations. 3. Advise executive leadership on material cyber risks, emerging threats, major incidents, strategic tradeoffs, and investment needs using clear business and financial context. 4. Own the cybersecurity operating model, annual planning, budget, workforce strategy, sourcing model, vendor portfolio, and prioritization of capabilities and initiatives. 5. Establish program-level objectives, key risk indicators, key performance indicators, maturity targets, and executive reporting that demonstrate risk reduction and operational outcomes. 6. Build strong partnerships across Information Technology, Enterprise Risk, Legal, Privacy, Internal Audit, Compliance, Human Resources, Finance, Supply Chain, and business functions. 7. Define and maintain the enterprise cybersecurity strategy, target-state capabilities, policy architecture, control framework, and prioritized roadmap. 8. Provide strategic direction for enterprise security architecture and security-by-design practices across cloud, on-premise, applications, infrastructure, data, and third-party services. 9. Present cyber risk posture, incidents,