Director, Information Security

The Director of Cybersecurity Compliance is responsible for leading the enterprise cybersecurity compliance program to ensure the organization meets applicable regulatory, contractual, industry, audit, and internal control requirements. This role leads the enterprise cybersecurity compliance function across regulatory, contractual, audit, and internal policy obligations and establishes a scalable operating model for a large, complex enterprise.

In a Fortune 500 environment, this role operates at enterprise scale and partners closely with Information Security, IT, Legal, Privacy, Enterprise Risk Management, Internal Audit, Compliance, Procurement, Finance, and business leadership. The Director ensures cybersecurity controls are designed, implemented, documented, monitored, and tested effectively; drives audit readiness and disciplined remediation governance; and provides executive visibility into cybersecurity compliance posture, control gaps, regulatory exposure, and program maturity.

This leader must translate complex cybersecurity, regulatory, and control requirements into practical enterprise processes that support business objectives while reducing cyber, regulatory, operational, legal, and reputational risk. The role also partners across the enterprise to embed cybersecurity compliance into technology, business, vendor, and risk management processes.

• Lead the enterprise cybersecurity compliance program, including strategy, roadmap, governance, operating model, procedures, control oversight, compliance monitoring, and reporting.
• Define and maintain cybersecurity compliance requirements aligned to applicable laws, regulations, industry standards, contractual obligations, and internal cybersecurity policies.
• Establish a risk-based approach for evaluating cybersecurity compliance across enterprise systems, business processes, applications, infrastructure, cloud environments, third parties, and critical technology services.
• Drive maturity of cybersecurity compliance processes, including control mapping, evidence management, issue tracking, audit support, reporting, and remediation governance.
• Serve as a senior cybersecurity compliance advisor to executive leadership, technology leaders, business stakeholders, Legal, Privacy, Enterprise Risk, Internal Audit, and Compliance teams.
• Ensure cybersecurity compliance activities are aligned to enterprise cyber strategy, risk appetite, regulatory expectations, and business priorities.

• Oversee alignment of cybersecurity controls and compliance activities to NIST CSF 2.0, NIST SP 800-53, NIST SP PHONE_NUMBER where applicable, SOC 2 Trust Services Criteria, PCI DSS, SOX IT General Controls, HIPAA/HITECH where applicable, GLBA where applicable, GDPR, CCPA/CPRA, SEC cybersecurity disclosure expectations where applicable, and customer or contractual cybersecurity requirements.
• Maintain a common control framework that rationalizes cybersecurity requirements across multiple regulatory and audit obligations.
• Partner with control owners to ensure cybersecurity controls are clearly defined, assigned, documented, tested, and evidenced.
• Identify control gaps, maturity opportunities, and overlapping requirements to improve efficiency and reduce compliance burden.
• Ensure compliance expectations are embedded into security architecture, identity and access management, vulnerability management, cloud security, incident response, data protection, application security, third-party risk, and business continuity processes.

• Lead cybersecurity compliance support for internal audits, external audits, regulatory examinations, customer assessments, SOX testing, PCI assessments, SOC reporting, and other assurance activities.
• Coordinate audit planning, evidence collection, walkthroughs, control owner engagement, management responses, remediation commitments, and closure validation.
• Establish repeatable evidence management processes to ensure timely, accurate, and complete responses to audit and compliance requests.
• Review audit findings and control deficiencies to assess root cause, risk impact, compensating controls, and remediation approach.
• Drive reduction of repeat findings through stronger control ownership, accountability, monitoring, and remediation governance.
• Partner with Internal Audit, Enterprise Risk, Legal, Privacy, and Compliance to ensure cybersecurity audit activities are coordinated and aligned to enterprise risk priorities.

• Own or support the development, maintenance, and enforcement of cybersecurity policies, standards, procedures, and control requirements.
• Ensure cybersecurity policies and standards reflect current regulatory expectations, threat landscape, enterprise risk appetite, business operations, and technology environment.
• Establish governance processes for policy exceptions, control deviations, compensating controls, and risk acceptances.
• Partner with cybersecurity domain leaders to ensure policies are practical, measurable, enforceable, and aligned to operational capabilities.
• Track policy adherence and report non-compliance trends to appropriate governance forums.
• Support executive and board-level reporting related to cybersecurity governance, compliance posture, audit readiness, and control maturity.

• Establish and oversee a cybersecurity control monitoring and testing program to evaluate the effectiveness of key security controls.
• Define control testing schedules, procedures, evidence requirements, sampling methods, control ownership, and quality standards.
• Monitor compliance with cybersecurity controls across enterprise technology environments, including cloud, infrastructure, applications, identity platforms, endpoints, networks, data repositories, and third-party services.
• Track cybersecurity compliance issues, audit findings, control gaps, policy exceptions, and remediation plans through closure.
• Ensure remediation plans include clear ownership, milestones, due dates, risk prioritization, and validation criteria.
• Escalate overdue, high-risk, or under-resourced remediation activities through appropriate governance channels.
• Validate closure of cybersecurity findings and ensure evidence supports sustainable remediation.

• Develop executive-level reporting on cybersecurity compliance posture, control effectiveness, audit findings, remediation status, regulatory obligations, policy exceptions, and program maturity.