Director of Information Security & Strategic Resilience

Accountabilities: Cybersecurity Strategy & Risk Management: Develop and execute a multi-year cybersecurity and resilience roadmap aligned with organizational priorities. Establish a risk-based security program informed by frameworks such as CIS Critical Security Controls, NIST CSF, NIST 800-53, SANS, and FAIR, supporting informed decisions on risk mitigation, acceptance, transfer, and avoidance. Governance, Policies & Compliance: Create and continuously improve enterprise security policies, standards, and procedures covering identity and access management, data protection, cloud security, application security, and incident response. Support audits, cyber-insurance requirements, regulatory obligations, and contractual compliance. Third-Party Risk Management: Establish and oversee security assessments and risk management processes for vendors, SaaS platforms, cloud providers, and external partners handling sensitive information. Security Architecture & Digital Transformation: Advise on security for identity and access management, cloud data platforms, analytics, integrations, enterprise SaaS, portals, and custom applications. Provide architectural guidance across Azure, Microsoft 365, Defender, Purview, and Intune while promoting secure software development and application testing. Cryptography & Secrets Management: Define enterprise practices for encryption, key management, tokenization, certificate lifecycle management, and secrets protection. Ensure sensitive data is appropriately protected across cloud services, integrations, automation, and custom applications. Vulnerability Management & Threat Analysis: Lead asset discovery, vulnerability scanning, remediation prioritization, penetration testing, and security assessments across networks, applications, cloud environments, and third parties. Apply threat modeling and business-risk analysis to guide remediation and control design. Security Operations & Detection: Mature endpoint detection and response (EDR), security information and event management (SIEM), and cloud-native security capabilities. Coordinate with managed security service providers (MSSPs) to strengthen monitoring, threat detection, and response. Incident Response & Resilience: Own incident response planning, tabletop exercises, and incident coordination with legal counsel, forensic specialists, and cyber-insurance partners. Lead business continuity and resilience planning, post-incident reviews, and continuous improvement initiatives. Data Protection, Privacy & AI Risk: Oversee data loss prevention, data classification, and privacy controls. Collaborate with data and analytics teams to safeguard sensitive stakeholder information and assess security, privacy, and ethical risks associated with AI, automation, and emerging technologies. Security Awareness & Performance Metrics: Develop security training tailored to staff, interns, and leadership. Promote shared responsibility for security and define meaningful KPIs and KRIs covering detection, response, vulnerability remediation, control coverage, and risk trends. Executive & Board Engagement: Support the CIO with board-level cybersecurity updates, risk reporting, and investment recommendations. Translate complex technical issues into clear business insights and act as a trusted security advisor to senior leadership. Team & Capability Development: Identify opportunities to expand internal security capabilities as the program evolves, balance internal resources with external expertise, and mentor technology staff in security best practices. Requirements Extensive Security Experience: 15+ years of experience in information security, with progressive responsibility in enterprise or cloud-first environments and demonstrated leadership in both strategic planning and hands-on security operations. Microsoft Security Expertise: Strong familiarity with the Microsoft security ecosystem, including Azure, Microsoft 365, Defender, SharePoint, and Intune. Security Engineering & Cryptography: Experience with secrets management solutions such as HashiCorp Vault or equivalent, encryption, key management, and related cryptographic controls. Operational Security Skills: Hands-on experience with incident response, SIEM, EDR, data loss prevention, vulnerability management, and penetration testing. Application & Cloud Security: Working knowledge of secure software development, enterprise application security, cloud security architecture, and secure integration practices. Risk Analysis & Threat Modeling: Strong understanding of FAIR risk analysis, threat modeling, security assessments, and risk-based remediation approaches. External Partner Management: Experience collaborating with MSSPs, vendors, and external security partners to deliver effective security capabilities. Executive Communication: Proven ability to communicate complex technical and risk-related topics clearly to executives and boards, supporting informed decisions and investment priorities. Strategic Leadership: Ability to balance security controls with usability, innovation, and organizational objectives while building a sustainable security culture. Preferred Experience: Background in nonprofit, education, or other mission-driven organizations is beneficial but not required. Familiarity with data governance, privacy principles, and AI risk management is also an advantage. Preferred Certifications: CISSP, CISM, CRISC, GIAC, or other relevant security certifications are welcome but not mandatory. Benefits Competitive annual salary of $135,000–$140,000, depending on experience and qualifications. Medical, dental, and vision insurance. Company-paid life and disability insurance. Generous paid time off and 10 company-paid holidays. Additional “Soft Close” period between Christmas and New Year’s. 403(b) retirement savings plan with company matching. Communications allowance. Focus Fridays to support dedicated work time and productivity. Flexible work arrangements in a remote US-based role.