Director of Information Security & Strategic Resilience

Job description

**This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Director of Information Security & Strategic Resilience based in the United States.** The Director of Information Security & Strategic Resilience will serve as the organization’s senior cybersecurity leader, driving the development and maturity of an enterprise-wide security and resilience program. Working closely with executive leadership, this role will establish risk-based strategies that protect sensitive information while enabling digital transformation and organizational growth. The position combines strategic oversight with hands-on expertise across security architecture, risk management, incident response, and cloud security. It will guide governance, compliance, threat detection, and business continuity initiatives while strengthening security practices across technology platforms and third-party partnerships. The Director will also advise senior leaders on cybersecurity investments, emerging technology risks, and resilience priorities. This is an opportunity to shape a forward-looking security culture in a remote-first environment while balancing robust protection with innovation and mission impact. ### Accountabilities - Cybersecurity Strategy & Risk Management: Develop and execute a multi-year cybersecurity and resilience roadmap aligned with organizational priorities. Establish a risk-based security program informed by frameworks such as CIS Critical Security Controls, NIST CSF, NIST 800-53, SANS, and FAIR, supporting informed decisions on risk mitigation, acceptance, transfer, and avoidance. - Governance, Policies & Compliance: Create and continuously improve enterprise security policies, standards, and procedures covering identity and access management, data protection, cloud security, application security, and incident response. Support audits, cyber-insurance requirements, regulatory obligations, and contractual compliance. - Third-Party Risk Management: Establish and oversee security assessments and risk management processes for vendors, SaaS platforms, cloud providers, and external partners handling sensitive information. - Security Architecture & Digital Transformation: Advise on security for identity and access management, cloud data platforms, analytics, integrations, enterprise SaaS, portals, and custom applications. Provide architectural guidance across Azure, Microsoft 365, Defender, Purview, and Intune while promoting secure software development and application testing. - Cryptography & Secrets Management: Define enterprise practices for encryption, key management, tokenization, certificate lifecycle management, and secrets protection. Ensure sensitive data is appropriately protected across cloud services, integrations, automation, and custom applications. - Vulnerability Management & Threat Analysis: Lead asset discovery, vulnerability scanning, remediation prioritization, penetration testing, and security assessments across networks, applications, cloud environments, and third parties. Apply threat modeling and business-risk analysis to guide remediation and control design. - Security Operations & Detection: Mature endpoint detection and response (EDR), security information and event management (SIEM), and cloud-native security capabilities. Coordinate with managed security service providers (MSSPs) to strengthen monitoring, threat detection, and response. - Incident Response & Resilience: Own incident response planning, tabletop exercises, and incident coordination with legal counsel, forensic specialists, and cyber-insurance partners. Lead business continuity and resilience planning, post-incident reviews, and continuous improvement initiatives. - Data Protection, Privacy & AI Risk: Oversee data loss prevention, data classification, and privacy controls. Collaborate with data and analytics teams to safeguard sensitive stakeholder information and assess security, privacy, and ethical risks associated with AI, automation, and emerging technologies. - Security Awareness & Performance Metrics: Develop security training tailored to staff, interns, and leadership. Promote shared responsibility for security and define meaningful KPIs and KRIs covering detection, response, vulnerability remediation, control coverage, and risk trends. - Executive & Board Engagement: Support the CIO with board-level cybersecurity updates, risk reporting, and investment recommendations. Translate complex technical issues into clear business insights and act as a trusted security advisor to senior leadership. - Team & Capability Development: Identify opportunities to expand internal security capabilities as the program evolves, balance internal resources with external expertise, and mentor technology staff in security best practices. ## Requirements - Extensive Security Experience: 15+ years of experience in information security, with progressive responsibility in enterprise or cloud-first environments and demonstrated leadership in both strategic planning and hands-on security operations. - Microsoft Security Expertise: Strong familiarity with the Microsoft security ecosystem, including Azure, Microsoft 365, Defender, SharePoint, and Intune. - Security Engineering & Cryptography: Experience with secrets management solutions such as HashiCorp Vault or equivalent, encryption, key management, and related cryptographic controls. - Operational Security Skills: Hands-on experience with incident response, SIEM, EDR, data loss prevention, vulnerability management, and penetration testing. - Application & Cloud Security: Working knowledge of secure software development, enterprise application security, cloud security architecture, and secure integration practices. - Risk Analysis & Threat Modeling: Strong understanding of FAIR risk analysis, threat modeling, security assessments, and risk-based remediation approaches. - External Partner Management: Experience collaborating with MSSPs, vendors, and external security partners to deliver effective security capabilities. - Executive Communication: Proven ability to communicate complex technical and risk-related topics clearly to executives and boards, supporting informed decisions and investment priorities. - Strategic Leadership: Ability to balance security controls with usability, innovation, and organizational objectives while building a sustainable security culture. - Preferred Experience: Background in nonprofit, education, or other mission-driven organizations is beneficial but not required. Familiarity with data governance, privacy principles, and AI risk management is also an advantage. - Preferred Certifications: CISSP, CISM, CRISC, GIAC, or other relevant security certifications are welcome but not mandatory. ## Benefits - Competitive annual salary of $135,000–$140,000, depending on experience and qualifications. - Medical, dental, and vision insurance. - Company-paid life and disability insurance. - Generous paid time off and 10 company-paid holidays. - Additional “Soft Close” period between Christmas and New Year’s. - 403(b) retirement savings plan with company matching. - Communications allowance. - Focus Fridays to support dedicated work time and productivity. - Flexible work arrangements in a remote US-based role.