Senior Director of Cybersecurity POST NUMBER: 484304

Lead internal cybersecurity personnel and contractors. 

Manage relationships with managed security providers, MDR providers, vulnerability management partners, penetration testing firms, and cybersecurity consultants. 

Direct security architecture, security operations, security engineering, governance, risk, and incident response functions. 

Provide leadership and mentorship for security professionals globally. 

Develop and maintain the enterprise cybersecurity strategy, roadmap, standards, and policies. 

Establish a risk-based cybersecurity program aligned to business objectives and organizational risk tolerance. 

Partner with executive leadership to ensure appropriate visibility into cyber risks and mitigation efforts. 

Create and maintain governance processes, reporting mechanisms, and executive dashboards; provide regular updates to the CIO, General Counsel, and Cybersecurity Risk Committee, and support the CIO in preparing periodic Board updates. 

Support the adoption and maintenance of security frameworks including ISO 27001, NIST, CIS Controls, and applicable regulatory requirements. 

Establish cybersecurity KPIs, performance metrics, and service-level objectives for internal teams and external providers. 

Direct enterprise security monitoring and detection capabilities through internal teams and managed security providers, including MDR, SIEM, EDR, and threat intelligence services. 

Establish and maintain incident response procedures, playbooks, and crisis management processes; lead investigations and coordinate response across business and technology teams. 

Conduct post-incident reviews and drive continuous improvement. 

Ensure appropriate logging, monitoring, and forensic capabilities exist across the organization. 

Establish governance and operational standards for Microsoft security capabilities, including Defender, Sentinel or equivalent SIEM integrations, Entra ID, conditional access, privileged access, endpoint protection, secure score management, and audit logging. 

Own the technology vulnerability management program, including scanning, remediation governance, prioritization, and reporting. 

Oversee external attack surface management and adversarial exposure validation. 

Establish risk-based remediation programs and service-level expectations. 

Track and report vulnerability trends, remediation performance, and risk posture. 

Coordinate remediation with infrastructure, cloud, application, and business teams. 

Establish enterprise security architecture standards and security design principles. 

Review major technology projects and ensure cybersecurity requirements are incorporated throughout the project lifecycle. 

Define secure architecture patterns for Microsoft 365 & Azure; SaaS E-commerce, ERP, and CRM systems; and internal and external AI. 

Lead implementation of zero-trust security principles across corporate systems and applications. 

Evaluate emerging cybersecurity technologies and make adoption recommendations. 

Mature governance and controls for identity and access management, including Microsoft Entra ID, privileged access management, MFA, conditional access, joiner/mover/leaver processes, and identity governance. 

Ensure periodic access reviews and segregation-of-duty controls are maintained. 

Develop and manage cybersecurity risk assessments across the enterprise; bring risk acceptance decisions above a defined severity/impact threshold to the CIO or risk committee for approval. 

Partner with legal, compliance, privacy, quality, and regulatory teams. 

Develop security standards supporting responsible adoption of AI technologies including Microsoft Copilot, generative AI platforms, AI governance, data protection, and emerging AI-related cyber risks.  

Support internal and external audits, and maintain cybersecurity metrics, risk reporting, and policy/control documentation. 

Manage cybersecurity policy lifecycle and related control documentation. 

Design, implement, monitor, and provide evidence for technical cybersecurity controls that support PCI-DSS, GDPR, CCPA, PIPEDA and similar 

Support cyber insurance renewal, underwriting evidence, and control validation, as well as executive attestations, audit evidence packages, and board-level risk reporting as requested by the CIO, General Counsel, or designated governance body. 

Develop a vendor security assessment program. 

Evaluate cybersecurity risks associated with vendors, suppliers, service providers, and technology partners. 

Review security requirements in contracts and vendor agreements. 

Participate in acquisition, implementation, and onboarding reviews for new technology solutions. 

Manage an enterprise security awareness program, including phishing simulation and training initiatives. 

Foster a culture of shared responsibility for cybersecurity across all business units. 

Develop executive and leadership-focused cyber-risk awareness programs. 

Develop and manage cybersecurity budgets. 

Establish measurable cybersecurity objectives and key results. 

Lead strategic planning and workforce development activities. 

Build high-performing teams capable of supporting a global business environment. 

Ensure vendor accountability through defined KPIs, SLAs, and outcome-based performance measures. 

Owns cybersecurity strategy, security architecture, technical security controls, vulnerability management, security monitoring, incident response coordination, identity security, and cybersecurity risk reporting. 

Has authority to require remediation of critical cybersecurity risks, establish minimum security standards, and escalate unresolved risks through executive governance.  

Partners with Legal, Compliance, and Privacy on regulatory interpretation, privacy obligations, breach notification decisions, external communications, and audit/compliance attestations. 

Partners with Infrastructure, Platform Engineering, Enterprise Applications, and IT Product teams to ensure secure design, implementation, operation, and remediation of technology platforms. 

May recommend risk acceptance, remediation plans, compensating controls, and escalation; formal acceptance of material cybersecurity risk requires approval by the CIO or designated governance body. 

Does not independently own privacy-law interpretation, regulatory filings, contractual legal positions, or final compliance attestations unless expressly delegated by executive leadership. 

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field, or equivalent experience. 

10 years of progressively responsible cybersecurity experience including 5 years leading cybersecurity programs and teams. 

Experience operating in a multinational organization. 

Comfortable operating as a hands-on, execution-oriented security leader in a growing organization, balancing program leadership with practical implementation, vendor oversight, and cross-functional remediation follow-through. 

Experience working with cloud security technologies, particularly Microsoft Azure and M365. 

Experience managing external cybersecurity service providers and remediation across teams that do not directly report to cybersecurity. 

Experience with enterprise SaaS, e-commerce, cloud, and identity-centric security environments 

CISSP, CISM or similar certification 

Experience building or maturing a cybersecurity program in a mid-sized or high-growth organization 

Microsoft Security Certifications (SC-100, SC-200, SC-300)