Vice President, Information Security
Papa Johns · Wayne County, MI · 1 mo ago
Information TechnologyFull-time
We need to output HTML fragment with sections: About the role? The posting includes Job Summary, Key Responsibilities, Qualifications, Values, Core Competencies. Also maybe Benefits? Not present. Pay? Not present. Schedule? Not present. So we include sections for which there is real content: About the role (Job Summary), Responsibilities (Key Responsibilities), Qualifications, Values, Core Competencies. Possibly also "Our Values" and "Our Core Competencies". Use for each heading. Use
for each heading. Use - for any list of duties/requirements/benefits. The responsibilities are many bullet-like sentences; we can treat each as list item. Qualifications also list. Values list. Core competencies list.
We must not repeat job title as heading. No Job ID. Remove boilerplate: EEO, E-Verify, etc. Also remove duplicated lines. The posting includes repeated E-Verify statements; we should drop them. Also remove application instructions (none). Also remove "Everybody loves pizza..." etc? That's maybe fluff but it's substantive? It's more marketing; but we should preserve ALL substantive information; not sure if that counts as substantive. It's not boilerplate; it's a motivational statement. Could keep as paragraph under maybe About the role? But it's after the values. Might be considered fluff but not boilerplate. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The pizza statement is not boilerplate; it's part of the posting. We'll keep it as a paragraph maybe under a section like "About Papa John's"? But we only create sections when there is real specific content. Could add a section "About Papa John's" but not in the list of allowed headings? The allowed headings are: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We should stick to those. So we can put the pizza statement under About the role as prose.
Thus sections: About the role (Job Summary + pizza statement maybe), Responsibilities (Key Responsibilities), Qualifications, Values (maybe treat as Skills? But Values is not in list; we could put under Skills? But better to create a section only when posting has real specific content for it; but we must use headings from the list. The list includes Skills. Could we put Values under Skills? Not ideal. However instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., implying those are examples, not exclusive? It says "Use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." Likely they expect only those headings. So we must map content to those headings. Values could go under Skills? Or maybe we can omit Values section if not matching allowed headings? But we must preserve ALL substantive information. If we omit Values, we lose info. Could we incorporate Values into About the role as prose? That would preserve but not as a separate heading. That's acceptable: we can include Values as a paragraph inside About the role. Similarly Core Competencies could go under Skills heading. That seems reasonable.
Thus:
About the role
Job Summary ...
What’s Unique About You Is What Makes Us Better! Diversity is our strength and competitive advantage. Bring your flavor to the Papa John's team today! Everybody loves pizza, which means they also love the people who are behind the scenes working to deliver it. This is complex and challenging work – but let’s face it – it’s also pizza! If you want a fulfilling career with a company that’s always moving forward, we’re the right place.
Responsibilities
- ...
... each responsibility as list item.
We need to split the responsibilities into items. The responsibilities are grouped under headings like Cybersecurity Strategy, Security Operations & Cyber Defense, etc. We could keep those as subheadings? But we cannot add extra headings beyond allowed? Could we add inside? Not prohibited but they said use for section headings. Could still use for sub-sections? Might be okay but safer to just list each responsibility as list item without subheadings. However we risk losing structure. But we can embed the subheading as bold text inside
- . That preserves info.
Similarly Qualifications list.
We need to ensure we don't include boilerplate like "Papa Johns is an equal opportunity employer." etc. Remove those lines.
Let's extract responsibilities text:
Cybersecurity Strategy
- Develop and execute a multi-year enterprise cybersecurity strategy and roadmap.
- Establish security priorities based on business risk and threat landscape.
- Define cybersecurity policies, standards, controls, and operating procedures.
- Provide executive leadership with clear visibility into cyber risk and security posture.
Security Operations & Cyber Defense
- Lead enterprise security operations and cyber defense capabilities.
- Oversee SOC, SIEM, EDR/XDR, MDR/MSSP, security monitoring, and threat detection.
- Improve detection, investigation, and response capabilities.
- Drive security automation and orchestration to improve operational effectiveness.
Incident Response & Cyber Resilience
- Establish and maintain the enterprise cyber incident response program.
- Lead response to significant cybersecurity incidents.
- Develop and maintain ransomware, phishing, credential compromise, data breach, DDoS, and other incident playbooks.
- Conduct regular tabletop exercises and cyber simulations.
- Partner with business continuity and disaster recovery teams to strengthen cyber resilience.
Identity & Access Security
- Establish strong identity and access security practices.
- Partner with IAM teams on MFA, PAM, SSO, Zero Trust, and least-privilege access.
- Protect workforce, privileged, third-party, and application identities.
- Reduce identity-based cyber risk.
Vulnerability & Threat Management
- Lead enterprise vulnerability and exposure management.
- Establish risk-based vulnerability prioritization and remediation.
- Develop threat intelligence capabilities to identify emerging threats.
- Ensure critical vulnerabilities and exposures receive appropriate executive visibility.
Security Architecture
- Establish enterprise information security architecture and security-by-design principles.
- Partner with technology and architecture teams to embed security into new products, applications, cloud platforms, and digital experiences.
- Evaluate emerging cybersecurity technologies and capabilities, including AI-driven security.
Application, Data & Digital Security
- Establish security requirements for applications, APIs, data, and customer-facing digital platforms.
- Partner with application development teams on secure SDLC and application security.
- Protect sensitive corporate and customer information.
- Strengthen controls around data protection, encryption, and privacy.
Third-Party & Supply Chain Security
- Establish cybersecurity requirements for critical vendors and technology partners.
- Assess and manage third-party cyber risk.
- Partner with Procurement, Legal, and Risk to ensure appropriate security controls are incorporated into contracts.
Governance, Risk & Compliance
- Partner with Risk, Compliance, Internal Audit, and Legal.
- Maintain cybersecurity control frameworks and policies.
- Lead remediation of security assessments and audit findings.
- Support applicable regulatory, privacy, PCI, and compliance requirements.
Leadership & Financial Management
- Lead, develop, and retain a high-performing information security organization.
- Establish clear accountability, KPIs, and operating rhythms.
- Manage cybersecurity operating and capital budgets.
- Lead strategic cybersecurity vendors and managed security providers.
- Build strong partnerships across technology and business organizations.
- Communicate complex cybersecurity risks in clear business and financial terms.
Now Qualifications:
- 10–15+ years of progressive experience in information security or cybersecurity.
- 5+ years of leadership experience managing cybersecurity teams.
- Experience leading enterprise cybersecurity transformation.
- Strong understanding of security operations, IAM, cloud security, application security, vulnerability management, incident response, and cyber risk.
- Experience managing significant budgets and strategic vendors.
- Strong executive communication and influencing skills.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field preferred.
- CISSP, CISM, CRISC, or equivalent certification preferred.
Values list (we will embed as paragraph maybe bullet list inside About the role? Could be a
inside About the role). Values:
- EVERYONE BELONGS - We believe connectedness and belonging are the essential ingredients to our success
- DO THE RIGHT THING - We are relentlessly focused on quality and integrity and make the right choices, even when it's difficult
- PEOPLE FIRST - To craft positive experiences for our customers, we take care of each other first
- INNOVATE TO WIN - We champion and challenge for a better way in all we do
- HAVE FUN - We find joy, create meaningful impact and celebrate the journey together
Core Competencies list:
- CUSTOMER CENTRIC - We leverage data and insights to craft a customer experience that builds relationships, cultivates trust, and delivers excellence
- RESULTS DRIVEN – We focus on measurable outcomes by remaining optimistic, tenacious, and persistent even in the face of challenges
- CONTINUOUS IMPROVEMENT - We champion for better through strategic risk taking, experimentation and challenging the status quo
- BIAS FOR ACTION - We courageously lead, drive towards decisions, and maintain agility to meet the demands of our dynamic industry
- WINNING TOGETHER - We work together to unlock our full potential by actively collaborating and contributing in a cross-functional capacity
We could put Values and Core Competencies under Skills heading as two sublists? Or we could make separate sections but not allowed. Perhaps we can treat Values as part of About the role and Core Competencies as Skills. That seems okay.
Thus final HTML:
About the role
Job Summary The VP, Information Security & Cybersecurity is responsible for developing and executing the organization's enterprise information security and cybersecurity strategy. This leader will protect the organization's people, data, applications, technology, and digital ecosystem from evolving cyber threats while enabling the business to operate securely and efficiently. The role provides strategic leadership across cyber defense, security operations, identity and access management, vulnerability management, security architecture, incident response, threat intelligence, security governance, and third-party risk. This role partners closely with the technology leadership, business executives, risk, legal, compliance, and audit teams to establish an effective, risk-based security program.
What’s Unique About You Is What Makes Us Better! Diversity is our strength and competitive advantage. Bring your flavor to the Papa John's team today! Everybody loves pizza, which means they also love the people who are behind the scenes working to deliver it. This is complex and challenging work – but let’s face it – it’s also pizza! If you want a fulfilling career with a company that’s always moving forward, we’re the right place.
- EVERYONE BELONGS - We believe connectedness and belonging are the essential ingredients to our success
- DO THE RIGHT THING - We are relentlessly focused on quality and integrity and make the right choices, even when it's difficult
- PEOPLE FIRST - To craft positive experiences for our customers, we take care of each other first
- INNOVATE TO WIN - We champion and challenge for a better way in all we do
- HAVE FUN - We find joy, create meaningful impact and celebrate the journey together
Responsibilities
- Cybersecurity Strategy Develop and execute a multi-year enterprise cybersecurity strategy and roadmap; Establish security priorities based on business risk and threat landscape; Define cybersecurity policies, standards, controls, and operating procedures; Provide executive leadership with clear visibility into cyber risk and security posture.
... but better to split each bullet as separate - . However we have many items; we could keep subheadings inside
- as bold text and then semicolon separated sub-items. That may be okay.
But we need to preserve ALL substantive information; splitting into separate
- for each bullet is fine.
Thus
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It says e.g., implying those are examples, not exclusive? It says "Use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." Likely they expect only those headings. So we must map content to those headings. Values could go under Skills? Or maybe we can omit Values section if not matching allowed headings? But we must preserve ALL substantive information. If we omit Values, we lose info. Could we incorporate Values into About the role as prose? That would preserve but not as a separate heading. That's acceptable: we can include Values as a paragraph inside About the role. Similarly Core Competencies could go under Skills heading. That seems reasonable.
Thus:
About the role
About the role
Job Summary ...
What’s Unique About You Is What Makes Us Better! Diversity is our strength and competitive advantage. Bring your flavor to the Papa John's team today! Everybody loves pizza, which means they also love the people who are behind the scenes working to deliver it. This is complex and challenging work – but let’s face it – it’s also pizza! If you want a fulfilling career with a company that’s always moving forward, we’re the right place.
Responsibilities
- ... ... each responsibility as list item. We need to split the responsibilities into items. The responsibilities are grouped under headings like Cybersecurity Strategy, Security Operations & Cyber Defense, etc. We could keep those as subheadings? But we cannot add extra headings beyond allowed? Could we add
- . That preserves info.
Similarly Qualifications list.
We need to ensure we don't include boilerplate like "Papa Johns is an equal opportunity employer." etc. Remove those lines.
Let's extract responsibilities text:
Cybersecurity Strategy
- Develop and execute a multi-year enterprise cybersecurity strategy and roadmap.
- Establish security priorities based on business risk and threat landscape.
- Define cybersecurity policies, standards, controls, and operating procedures.
- Provide executive leadership with clear visibility into cyber risk and security posture.
Security Operations & Cyber Defense
- Lead enterprise security operations and cyber defense capabilities.
- Oversee SOC, SIEM, EDR/XDR, MDR/MSSP, security monitoring, and threat detection.
- Improve detection, investigation, and response capabilities.
- Drive security automation and orchestration to improve operational effectiveness.
Incident Response & Cyber Resilience
- Establish and maintain the enterprise cyber incident response program.
- Lead response to significant cybersecurity incidents.
- Develop and maintain ransomware, phishing, credential compromise, data breach, DDoS, and other incident playbooks.
- Conduct regular tabletop exercises and cyber simulations.
- Partner with business continuity and disaster recovery teams to strengthen cyber resilience.
Identity & Access Security
- Establish strong identity and access security practices.
- Partner with IAM teams on MFA, PAM, SSO, Zero Trust, and least-privilege access.
- Protect workforce, privileged, third-party, and application identities.
- Reduce identity-based cyber risk.
Vulnerability & Threat Management
- Lead enterprise vulnerability and exposure management.
- Establish risk-based vulnerability prioritization and remediation.
- Develop threat intelligence capabilities to identify emerging threats.
- Ensure critical vulnerabilities and exposures receive appropriate executive visibility.
Security Architecture
- Establish enterprise information security architecture and security-by-design principles.
- Partner with technology and architecture teams to embed security into new products, applications, cloud platforms, and digital experiences.
- Evaluate emerging cybersecurity technologies and capabilities, including AI-driven security.
Application, Data & Digital Security
- Establish security requirements for applications, APIs, data, and customer-facing digital platforms.
- Partner with application development teams on secure SDLC and application security.
- Protect sensitive corporate and customer information.
- Strengthen controls around data protection, encryption, and privacy.
Third-Party & Supply Chain Security
- Establish cybersecurity requirements for critical vendors and technology partners.
- Assess and manage third-party cyber risk.
- Partner with Procurement, Legal, and Risk to ensure appropriate security controls are incorporated into contracts.
Governance, Risk & Compliance
- Partner with Risk, Compliance, Internal Audit, and Legal.
- Maintain cybersecurity control frameworks and policies.
- Lead remediation of security assessments and audit findings.
- Support applicable regulatory, privacy, PCI, and compliance requirements.
Leadership & Financial Management
- Lead, develop, and retain a high-performing information security organization.
- Establish clear accountability, KPIs, and operating rhythms.
- Manage cybersecurity operating and capital budgets.
- Lead strategic cybersecurity vendors and managed security providers.
- Build strong partnerships across technology and business organizations.
- Communicate complex cybersecurity risks in clear business and financial terms.
Now Qualifications:
- 10–15+ years of progressive experience in information security or cybersecurity.
- 5+ years of leadership experience managing cybersecurity teams.
- Experience leading enterprise cybersecurity transformation.
- Strong understanding of security operations, IAM, cloud security, application security, vulnerability management, incident response, and cyber risk.
- Experience managing significant budgets and strategic vendors.
- Strong executive communication and influencing skills.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field preferred.
- CISSP, CISM, CRISC, or equivalent certification preferred.
Values list (we will embed as paragraph maybe bullet list inside About the role? Could be a
- inside About the role). Values:
- EVERYONE BELONGS - We believe connectedness and belonging are the essential ingredients to our success
- DO THE RIGHT THING - We are relentlessly focused on quality and integrity and make the right choices, even when it's difficult
- PEOPLE FIRST - To craft positive experiences for our customers, we take care of each other first
- INNOVATE TO WIN - We champion and challenge for a better way in all we do
- HAVE FUN - We find joy, create meaningful impact and celebrate the journey together
Core Competencies list:
- CUSTOMER CENTRIC - We leverage data and insights to craft a customer experience that builds relationships, cultivates trust, and delivers excellence
- RESULTS DRIVEN – We focus on measurable outcomes by remaining optimistic, tenacious, and persistent even in the face of challenges
- CONTINUOUS IMPROVEMENT - We champion for better through strategic risk taking, experimentation and challenging the status quo
- BIAS FOR ACTION - We courageously lead, drive towards decisions, and maintain agility to meet the demands of our dynamic industry
- WINNING TOGETHER - We work together to unlock our full potential by actively collaborating and contributing in a cross-functional capacity
We could put Values and Core Competencies under Skills heading as two sublists? Or we could make separate sections but not allowed. Perhaps we can treat Values as part of About the role and Core Competencies as Skills. That seems okay.
Thus final HTML:
- EVERYONE BELONGS - We believe connectedness and belonging are the essential ingredients to our success
- DO THE RIGHT THING - We are relentlessly focused on quality and integrity and make the right choices, even when it's difficult
- PEOPLE FIRST - To craft positive experiences for our customers, we take care of each other first
- INNOVATE TO WIN - We champion and challenge for a better way in all we do
- HAVE FUN - We find joy, create meaningful impact and celebrate the journey together
- Cybersecurity Strategy Develop and execute a multi-year enterprise cybersecurity strategy and roadmap; Establish security priorities based on business risk and threat landscape; Define cybersecurity policies, standards, controls, and operating procedures; Provide executive leadership with clear visibility into cyber risk and security posture. ... but better to split each bullet as separate
- . However we have many items; we could keep subheadings inside
- as bold text and then semicolon separated sub-items. That may be okay. But we need to preserve ALL substantive information; splitting into separate
- for each bullet is fine. Thus
About the role
Job Summary The VP, Information Security & Cybersecurity is responsible for developing and executing the organization's enterprise information security and cybersecurity strategy. This leader will protect the organization's people, data, applications, technology, and digital ecosystem from evolving cyber threats while enabling the business to operate securely and efficiently. The role provides strategic leadership across cyber defense, security operations, identity and access management, vulnerability management, security architecture, incident response, threat intelligence, security governance, and third-party risk. This role partners closely with the technology leadership, business executives, risk, legal, compliance, and audit teams to establish an effective, risk-based security program.
What’s Unique About You Is What Makes Us Better! Diversity is our strength and competitive advantage. Bring your flavor to the Papa John's team today! Everybody loves pizza, which means they also love the people who are behind the scenes working to deliver it. This is complex and challenging work – but let’s face it – it’s also pizza! If you want a fulfilling career with a company that’s always moving forward, we’re the right place.
Responsibilities