This position is listed on behalf of a partner company, who manages all applications and next steps. The partner is looking for a Director of Information Security & Strategic Resilience based in the United States.
Responsibilities
Develop and execute a multi-year cybersecurity and resilience roadmap aligned with organizational priorities.
Establish a risk-based security program informed by CIS Critical Security Controls, NIST CSF, NIST 800-53, SANS, and FAIR.
Create and improve enterprise security policies, standards, and procedures covering IAM, data protection, cloud security, application security, and incident response.
Support audits, cyber-insurance requirements, regulatory obligations, and contractual compliance.
Establish and oversee security assessments and risk management for vendors, SaaS platforms, cloud providers, and external partners.
Advise on security for IAM, cloud data platforms, analytics, integrations, enterprise SaaS, portals, and custom applications across Azure, Microsoft 365, Defender, Purview, and Intune.
Define enterprise practices for encryption, key management, tokenization, certificate lifecycle management, and secrets protection.
Lead asset discovery, vulnerability scanning, remediation prioritization, penetration testing, and security assessments.
Mature EDR, SIEM, and cloud-native security capabilities; coordinate with MSSPs.
Own incident response planning, tabletop exercises, and coordination with legal counsel, forensic specialists, and cyber-insurance partners.
Oversee data loss prevention, data classification, and privacy controls; assess security, privacy, and ethical risks of AI and automation.
Develop security training and define KPIs and KRIs.
Support the CIO with board-level cybersecurity updates, risk reporting, and investment recommendations.
Mentor technology staff in security best practices.
Requirements
15+ years of experience in information security with progressive responsibility in enterprise or cloud-first environments.
Strong familiarity with the Microsoft security ecosystem: Azure, Microsoft 365, Defender, SharePoint, and Intune.
Experience with secrets management solutions such as HashiCorp Vault or equivalent, encryption, key management, and cryptographic controls.
Hands-on experience with incident response, SIEM, EDR, data loss prevention, vulnerability management, and penetration testing.
Working knowledge of secure software development, enterprise application security, cloud security architecture, and secure integration practices.
Strong understanding of FAIR risk analysis, threat modeling, security assessments, and risk-based strategies.