Director of IT & Security

Core Responsibilities

1. Information Security Leadership

• Drive organizational maturity and adoption of the enterprise information security program, including threat intelligence, vulnerability management, and incident response.
• Champion and communicate the organization's security posture across on-prem, cloud, SaaS, and hybrid environments.
• Maintain executive visibility into security operations, including SIEM, penetration testing, and incident readiness programs.
• Serve as a senior strategic advisor on InfoSec, partnering with technical leads on architecture decisions, vendor selection, and product development.
• Partner with the security engineering team to amplify training programs, phishing simulations, and security awareness initiatives across the organization.
• Own executive communication and stakeholder coordination during security incidents, working in close partnership with technical leads on response execution.

2. Policy Creation & Governance

• Develop, own, and maintain the full library of IT and security policies, including AI and Agentic Use, Acceptable Use, Data Classification, Access Control, Incident Response, Business Continuity, and Disaster Recovery.
• Maintain and evolve existing governance frameworks, ensuring policies remain enforced, current, and responsive to regulatory changes and emerging threats.
• Deep understanding and expertise in leading compliance programs: SOC 2 Type II, SOX ITGC, ISO 27001, NIST CSF, GDPR, CCPA, and other applicable standards.
• Build and chair a cross-functional IT Governance Committee to align technology policy with business needs.
• Drive policy adoption through communication, training, and accountability mechanisms across all departments.

3. AI Security, Governance & Enablement

• Maintain and evolve the organization's established AI security policy and governance framework, ensuring it remains current across acceptable use, data handling, model risk, and third-party AI vendor assessment.
• Continuously assess and mitigate AI-specific security risks, including pr