Job Description

The Director of Information Assurance owns the enterprise information security, cybersecurity, and risk management program for a large organization with a network of locations across the country. This is a working leadership role: the Director sets security strategy and governance for the enterprise while remaining directly accountable for day-to-day security operations, threat detection, vulnerability management, and incident response.

The position is the senior-most dedicated security authority in the organization and serves as the primary escalation point for security incidents affecting all lines of business. The Director partners closely with IT infrastructure, applications, operations leadership, legal, human resources, internal audit, and executive management, and represents the security program to customers, insurers, auditors, and the parent organization.

COMPENSATION
$160K to $190K plus bonus and incentives

RESPONSIBILITIES

• Oversee, sustain, and continuously strengthen the enterprise information security program, encompassing the multi-year security roadmap, capability model, and annual goals aligned with business strategy and operational risk tolerance.
• Develop and administer the information security operating and capital budget; build business cases, evaluate and negotiate security tooling and services, and demonstrate return on security investment.
• Serve as the organization's security subject-matter authority
• Author, publish, and enforce enterprise security policies, standards, and procedures; drive the annual policy review and exception-management process.
• Take full ownership of the incident response program by maintaining the IR plan and playbooks, overseeing triage and containment, directing forensic investigations and root-cause analyses, coordinating legal and regulatory notifications, and conducting post-incident reviews with documented corrective actions.
• Manage enterprise vulnerability management lifecycle — asset discovery, continuous scanning, risk-based prioritization, remediation SLAs, and verification — across servers, endpoints, network devices, cloud workloads, and internet-facing assets.
• Oversee threat intelligence consumption and operationalization, with particular attention to threat actors and fraud schemes within the industry.
• Own program alignment and self-assessment against recognized frameworks (NIST Cybersecurity Framework, NIST 800-53/800-171 as applicable, CIS Critical Security Controls, ISO 27001 principles).
• Build, strengthen, guide, and retain the information security team while establishing role expectations, career development paths, certification objectives, and succession plans for critical positions.
• Guide IT staff in applying secure practices and while advancing the organization’s overall security maturity.

REQUIRED QUALIFICATIONS

• Five to seven years of information security or cybersecurity experience, including three years in a formal leadership position with responsibilities for direct reports and budget oversight.
• Demonstrated hands-on expertise in security monitoring, incident response, and vulnerability management, with a proven record of leading the response through significant security incident.
• US Citizenship or Green Card.

EDUCATION

• Bachelor's degree in information systems, computer science, cybersecurity, or a related field; equivalent progressive professional experience will be considered in lieu of a degree.
• Master's degree in cybersecurity, information systems, or business administration preferred
• One or more of the following strongly preferred: CISSP, CISM, CRISC, CISA, GIAC certifications (GSEC, GCIH, GCIA, GSLC), or CCISO.
• Cloud security credentials (AZ-500, AWS Security Specialty, CCSP) are a plus.