Senior Director, Chief Information Security Officer

Position Responsibilities

Cybersecurity Strategy & Program Leadership

• Define and execute the enterprise cybersecurity strategy, roadmap, priorities, and operating model
• Establish cybersecurity governance, policies, standards, and control frameworks aligned with business objectives and organizational growth
• Prioritize cybersecurity maturity initiatives based on business risk, regulatory expectations, commercial growth, and organizational scale
• Drive continuous improvement of cybersecurity capabilities and maturity across the organization
• Serve as the primary cybersecurity advisor to the CIO, Board of Directors, and business leadership
• Translate cybersecurity risks and opportunities into clear, actionable business recommendations

Security Architecture & Engineering

• Own the cybersecurity target-state architecture and security technology roadmap
• Lead cybersecurity architecture and engineering across cloud, infrastructure, identity, endpoint, network, application, SaaS, and data environments
• Embed secure-by-design and risk-based security principles across enterprise initiatives and technology platforms
• Partner with technology teams to integrate security requirements into solution design, implementation, and operational support models
• Evaluate, select, and optimize cybersecurity technologies and services that support business and regulatory requirements

Security Operations & Cyber Resilience

• Own security operations capabilities, including vulnerability management, incident response, security monitoring, identity security, and cyber resilience
• Establish and mature detection, response, recovery, and continuous improvement capabilities
• Lead cybersecurity incident response activities, executive communications, and post-incident reviews
• Partner with technology teams and service providers to strengthen operational security capabilities and reduce enterprise risk
• Support business continuity, disaster recovery, and cyber resilience planning in partnership with IT and business stakeholders

Governance, Risk & Compliance

• Lead the enterprise cybersecurity governance, risk, and compliance program
• Establish and maintain cybersecurity risk management processes, risk assessments, remediation plans, and risk reporting
• Support SOX IT General Controls, user access governance, change management controls, and third-party risk management activities
• Maintain alignment with the NIST Cybersecurity Framework and applicable regulatory requirements
• Develop meaningful cybersecurity metrics, KPIs, KRIs, and executive reporting
• Prepare cybersecurity risk, maturity, roadmap, and investment updates for senior leadership and audit committee discussions, as appropriate

Data Protection & Privacy

• Lead cybersecurity capabilities to protect sensitive company data, intellectual property, clinical data, regulated information, and business-critical records
• Partner with Legal, Privacy, Quality, Data & Analytics, and business stakeholders to support data governance, data classification, access controls, and security-related privacy requirements
• Strengthen data protection capabilities across cloud, SaaS, endpoint, collaboration, and enterprise application environments
• Support implementation of privacy-by-design and least privilege principles in alignment with regulatory and business requirements
• Partner with Legal and Privacy on security considerations related to data protection, privacy obligations, vendor risk, and evolving regulatory expectations

Audit, Quality & Regulatory Readiness

• Serve as the cybersecurity lead for internal audits, external audits, inspections, and cybersecurity assessments
• Partner with Privacy, Legal, Quality, and IT stakeholders to ensure cybersecurity controls support compliance obligations
• Ensure cybersecurity controls support GxP-regulated systems, Computer System Validation, and data integrity
• Drive timely remediation of audit findings, observations, and control deficiencies

Vendor & Managed Service Leadership

• Define and lead the cybersecurity operating model, leveraging internal teams, managed service providers, consultants, and strategic partners
• Own strategic relationships with cybersecurity vendors, MSSPs, consultants, and external partners, including governance, performance management, and accountability
• Establish service expectations, SLAs, KPIs, KRIs, operational metrics, and accountability mechanisms for third-party providers
• Conduct operational and executive-level performance reviews to ensure cybersecurity services meet business, compliance, regulatory, and operational objectives
• Partner with Procurement, Legal, Finance, and IT leadership on vendor selection, contract negotiations, renewals, investment decisions, and build vs. buy vs. outsource decisions

Executive Communication & Business Partnership

• Develop and deliver cybersecurity strategy updates, risk assessments, roadmap reviews, audit results, and investment recommendations to senior leadership
• Communicate cybersecurity risks and opportunities in clear business, operational, regulatory, and financial terms
• Build trusted relationships across business and technology functions
• Influence enterprise decision-making through practical, risk-based recommendations and effective stakeholder management
• Serve as a pragmatic advisor who enables business growth while maintaining appropriate risk discipline

People Leadership

• Lead, coach, mentor, and develop cybersecurity personnel and security-focused resources
• Provide leadership across employees, contractors, consultants, and managed service providers
• Foster a culture of accountability, continuous improvement, collaboration, and operational excellence
• Help shape the future cybersecurity organization as the company continues to scale
• Build a security culture that is practical, business-aligned, and appropriate for a growing commercial biotechnology company

Candidate Requirements

• Bachelor’s degree in Information Security, Computer Science, Engineering, Information Technology, or a related discipline
• 12+ years of progressive cybersecurity experience with increasing leadership responsibilities
• Demonstrated leadership experience spanning cybersecurity architecture, engineering, and operational security functions
• Experience building, implementing, or maturing enterprise cybersecurity programs and capabilities
• Experience leading cybersecurity initiatives within regulated environments
• Strong knowledge of the NIST Cybersecurity Framework, cybersecurity governance, risk management, and security control implementation
• Experience supporting audits, compliance programs, risk assessments, and remediation activities
• Experience with data protection, access governance, third-party risk, and security controls for cloud, SaaS, endpoint, and enterprise application environments
• Experience managing cybersecurity vendors, managed service providers, and outsourced security services
• Proven ability to communicate effectively with executive leadership and influence organizational decision-making
• Strong presentation, communication, and stakeholder management skills
• CISSP certification required

Preferred Qualifications

• Experience in biotechnology, pharmaceutical, life sciences, healthcare, or medical device industries
• Experience supporting GxP-regulated systems, Computer System Validation, Quality Management Systems, and inspection readiness activities
• Experience supporting SOX compliance and IT General Controls
• Familiarity with cloud security, identity and access management, vulnerability management, data protection, cybersecurity operations, and cyber resilience programs
• Experience partnering with Legal and Privacy teams on data protection, privacy-by-design, data classification, access control, and vendor risk considerations
• Experience supporting commercial-stage companies through growth, scale, geographic expansion, or increasing regulatory complexity
• CISM, CRISC, CCSP, GIAC, CISA, or ISO 27001 certifications preferred