cybersecurity director

Tennessee Board of Regents

Southwest Tennessee Community College is a comprehensive, multicultural, public, open—access college. Southwest has four campuses/centers from which it offers over 100 programs and over 20 technical certificate programs.
 
We foster student success, transform lives, and increase the educational level of a growing community in Shelby County. Southwest is a Tennessee Board of Regents institution, accredited by the Commission on Colleges of the Southern Association of Colleges and Schools.
 
We invite you to become a part of the Southwest Team!
 
Title: Director - IT Security
 
Employee Classification: Other Professionals
 
Institution: Southwest Tennessee Community College
 
Department: Information Systems
 
Campus Location: STCC - Multiple Campus Locations
 
Job Summary
 
This is a full-time permanent, fiscal year position in the Division of Administrative Services reporting to the Deputy Chief Information Officer. The Director of IT Security provides strategic leadership and oversight of the institution’s cybersecurity posture. This critical role ensures that the College’s information systems are protected from internal and external threats by developing, implementing, and maintaining security protocols and training programs. The Director will guide security-related decisions, proactively manage risk, and promote a culture of cybersecurity awareness across the organization.
 
Job Duties
 
Lead the College’s information security program, including development and delivery of cybersecurity awareness training and policy education.
 Collaborate with departments including Internal Audit and Finance/Controller to identify risks and implement IT risk mitigation strategies.
 Research and stay current on emerging cybersecurity threats, tools, and trends.
 Monitor institutional networks and systems for security breaches; respond to and investigate incidents as needed.
 Provide leadership, guidance, and supervision to security, identity management, and compliance staff.
 Oversee the College’s incident response plan and ensure policy compliance; lead efforts to remediate violations.
 Direct the implementation of security tools such as firewalls, encryption, and monitoring software.
 Recommend and implement IT security standards and best practices.
 Assist technical staff and end users with the deployment and understanding of security tools and practices.
 Coordinate and conduct periodic IT security audits.
 Maintain up-to-date knowledge of cybersecurity through professional development and industry resources.
 Perform other duties as assigned.
 
Minimum Qualifications
 
Bachelor’s degree in Information Technology, Cybersecurity, Audit or a related field.
 
Three (3) to five (5) years of relevant IT experience with a focus on cybersecurity.
 
CISSP certification (or equivalent experience) is a plus.
 
Project Management certification (e.g., PMP) is a plus.
 
Preferred Qualifications
 
Experience in higher education or similarly complex environments.
 
Familiarity with security compliance frameworks (e.g., NIST, FERPA, HIPAA).
 
Leadership experience in cross-functional IT teams or cybersecurity projects.
 
Knowledge, Skills, and Abilities
 
Demonstrated knowledge of network security technologies, protocols, and practices.
 
Proven ability to communicate effectively with both technical and non-technical stakeholders.
 
Strong interpersonal, verbal, and written communication skills.
 
Excellent problem-solving, analytical, time management, and organizational skills.
 
The intent of this job description is to provide a representation of the types of duties and responsibilities that will be required of positions given this title and shall not be construed as a declaration of the total specific duties and responsibilities of any particular position. Employees may be directed to perform job-related tasks other than those specifically presented in this description.
 
Candidates who are called for an interview must notify Human Resources in writing at least five (5) days in advance of any reasonable accommodation needed prior to the date of the interview.
 
First consideration will be given to current Southwest Tennessee Community College employees who meet the minimum qualifications for the position.
 
In order to be considered for the position, the following items must be uploaded:
 
Resume
 Cover letter
 Unofficial Transcripts
 
A summary of our benefits can be found below: 
https://www.southwest.tn.edu/hr/benefits-overview.php
 
Incomplete applications will not be considered.
 
The TBR does not discriminate on the basis of race, color, religion, creed, ethnicity, or national origin, sex, disability, age, status as a protected veteran or any other class protected by Federal or State laws and regulations and by Tennessee Board of Regents policies with respect to employment, programs, and activities.
 
The following person has been designated to handle inquiries regarding nondiscrimination policies: LeVetta Hudson, Vice President of People & Culture, myhr@southwest.tn.edu, 737 Union Ave, Memphis, TN 38103, 901-333-5000. See the full non-discrimination policy.

Director - IT Security

Metropolitan Community College (Neb.)

<div>Classification
Regular
Minimum Pay
$95,241.00
Compensation will be commensurate with the level of the position, education, and experience.
JOB DESCRIPTION SUMMARY
This position offers a competitive salary commensurate with experience and qualifications. In addition, we provide a comprehensive benefits package that supports your health, well-being, and professional growth
 
 
The Director of IT Cybersecurity, Risk and Compliance provides leadership in cybersecurity and responsible for the assessing and documenting of the College&rsquo;s compliance and risk posture as they relate to the ITS information assets. This role leads the development, implementation, and continuous improvement of a comprehensive cybersecurity and information security risk management program. This position provides highly technical and information security expertise proactively identifying emerging threats and driving mitigation strategies. The Director oversees the enforcement of internal security policies and procedures and manages user system access and identity management based on industry-standard best practices and compliance requirements, manages 3rd party risks, and provides input for data governance.
ESSENTIAL POSITION FUNCTIONS:
Leadership
<ul><li>Demonstrates leadership in ethical and practical compliance to enhance institutional trust, strengthen reputation, and support risk-informed decision-making.
</li><li>Promotes ethical business practices across the College by providing comprehensive education and establishing procedures to achieve the highest standards of compliance.
</li><li>Maintains the College&rsquo;s goals, culture, data collection, data storage, data processing, and data reported.
</li><li>Recommends programmatic and technical strategies, demonstrating a high level of independence in conducting investigations while upholding confidentiality and assessing the impact and analysis of security incidents, as well as making informed decisions regarding risk management and implementing computer and network security measures.
</li></ul>Cybersecurity
<ul><li>Establishes and maintains the College&rsquo;s cybersecurity governance model, including policies, standards, risk oversight, and performance reporting to senior leadership.
</li><li>Develops and maintains security metrics and dashboards (risk posture, compliance status, control health, vulnerability trends, training completion, and audit remediation status).
</li><li>Provides senior level guidance on cybersecurity priorities and risk acceptance decisions while communicating risk in clear business terms.
</li></ul>Risk
<ul><li>Leads the development and implementation of the system-wide risk management function of the information security program to ensure information security risks are identified and monitored.
</li><li>Internally assesses, evaluates and makes recommendations to management regarding the adequacy of the security controls for the College's information and technology systems.
</li></ul>Compliance
<ul><li>Leads the system-wide information security compliance program, ensuring IT activities, processes, and procedures meet defined requirements, policies and regulations.
</li><li>Develops and implements effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation.
</li><li>Executes strategy for dealing with increasing number of audits, compliance checks and external assessment processes for internal/external auditors, PCI DSS, FERPA, HIPAA, NIST 800-171,GDPR, and GLBA safeguards.
</li></ul>Outreach / Awareness
<ul><li>Interacts in both oral and written communications with all levels of System staff including; computer support staff, developers and other ITS staff, Enrollment Services, Financial Aid, Instructional Design Services, Finance, General Counsel, MCC Police, auditors, and all system staff and students, technology vendors and contractors, in matters related to information security and security awareness materials.
</li><li>Coordinates cyber readiness and resilience activities with business continuity and disaster recovery planning, including recovery testing and restoration validation.
</li><li>Oversees governance for identity and access management (IAM) and privileged access controls in collaboration with IT teams, ensuring least privilege and compliance-driven access practices
</li><li>Develops strategies to address awareness and training for all stakeholders as well as technical solutions.
</li></ul>Audit
<ul><li>Works with College Financial office, and outside consultants as appropriate on required security assessments and audits.
</li><li>Coordinates and tracks all information technology and security related audits including scope of audits, colleges/units involved, timelines, auditing agencies and outcomes. Work with auditors as appropriate to keep audit focus in scope, maintain excellent relationships with audit. Provide guidance, evaluation and advocacy on audit responses.
</li><li>Consistently and dependably attends work, activities, and functions as scheduled or assigned.
</li></ul>KNOWLEDGE, SKILLS AND ABILITIES:
<ul><li>Knowledge of cybersecurity governance and risk management frameworks, including establishing strategy, roles, policies, and oversight.
</li><li>Knowledge of NIST CSF 2.0 and ability to implement and report using the six core functions: Govern, Identify, Protect, Detect, Respond, and Recover.
</li><li>Ability to lead incident management and coordination, including communication, mitigation, and continuous improvement.
</li><li>Knowledge and understanding of campus policy development and dissemination.
</li><li>Must be familiar with policies affecting the higher education environment in the following areas of Student Privacy, Health Care, Finance, Institutional Research and State/Federal Regulations.
</li><li>Possess skills needed to assess computer hardware, software, and network systems for security risks or violations and work with ITS and campus staff and technology vendors to recommend solutions.
</li><li>Excellent interpersonal, communication, and presentation skills, including formal report writing.
</li><li>Possess strong customer service skills and the ability to project that attitude to customers in remote locations.
</li><li>Ability to assess the status of complex multi-location projects as well as identify and implement appropriate corrective measures to resolve issues as they arise.
</li><li>Ability to operate with a high degree of independence with regard to project management activities, including development of project plans and budget/resource estimates that align with mission.
</li><li>Ability to develop security standards and guidelines based on best practices and industry standards.
</li><li>Ability to effectively work and interact with various cultures and ethnicities.
</li></ul>MINIMUM QUALIFICATIONS FOR EDUCATION AND EXPERIENCE:
<ul><li>Bachelor&rsquo;s Degree in Information Technology or related field.
</li><li>Seven (7) years of full-time related work experience to include communicating, analyzing and responding to information security incidents.
</li><li>Experience planning and managing projects required.
</li><li>Information security experience in a higher education or state/local government environment preferred.
</li><li>CISM or CISSP preferred.
</li><li>Equivalent combination of education and/or work experience considered.
</li><li>Must pass a background check.
</li></ul>The specific statements shown in each section of this description are not intended to be all inclusive. They represent typical elements and criteria considered necessary to perform the job successfully. Metropolitan Community College recognizes that an individual with a disability may require an accommodation to enable the candidate to successfully perform a job function. Consideration will be given to reasonable accommodations .</div>

Director of IT Cybersecurity, Risk and Compliance

Chalhoub Group

<div>INSPIRE | EXHILARATE | DELIGHT
For over seven decades, Chalhoub Group has been a partner and creator of luxury experiences in the Middle East. In its pursuit to excel as a hybrid luxury retailer, the Group has curated a portfolio of over 10 owned brands and strengthened its distribution and marketing expertise for over 400 international names across luxury fashion, beauty, jewellery, watches, eyewear, and art de vivre categories.
Every step at Chalhoub Group is taken to build a future where luxury dreams become reality &mdash; bridging cultures and crafting memorable experiences for our consumers. Be it by constantly reinventing itself, committing to innovation, or embracing new technologies, the Group is shaping the future of luxury retail. It delivers seamless omnichannel experiences across more than 950 stores, online platforms, and mobile apps. Driving this innovation journey is The Greenhouse &mdash; the Group&rsquo;s innovation hub, incubator, and accelerator for startups and emerging businesses, regionally and globally.
Chalhoub Group fosters a people-at-heart culture rooted in diversity, equity, and inclusion, and a workplace catalysed by forward thinking and future-proofing. Today, it brings together over 16,000 talented professionals across eight countries in the Middle East, with a presence in LATAM. Their collective efforts have earned the Group the Great Place to Work certification in several markets.
Sustainability is at the core of the Group&rsquo;s strategy, guided by a clear commitment to people, partners, and the planet. Chalhoub Group is proud to be a member of the United Nations Global Compact, a signatory of the Women&rsquo;s Empowerment Principles, and to have pledged to reach Net Zero by 2040. 
What You'll Be Doing
The Director of Information Security - GRC is a senior leadership role responsible for governing and institutionalizing cybersecurity risk, regulatory compliance, and control frameworks across Chalhoub Group&rsquo;s global operations. This role leads the design, implementation, and continuous enhancement of enterprise-wide GRC programs, enabling risk-informed decision-making, regulatory confidence, and security accountability across all business units.
As a key member of the Group&rsquo;s cybersecurity leadership team, this position partners with Legal, Internal Audit, Data Privacy, Procurement, HR, Retail Operations, and Technology to operationalize trust, embed policies, and ensure adherence to global and regional standards.
Key Responsibilities
GRC Strategy &amp; Operating Model - Design and execute the Group&rsquo;s Information Security GRC strategy, aligned with corporate risk management, technology transformation, and global expansion. Define the operating model, team structure, and KPIs to ensure scalable, repeatable, and effective governance practices.
Governance &amp; Policy Management - Develop, maintain, and socialize Group-wide security policies, standards, and procedures in alignment with ISO 27001, NIST CSF, COBIT, and business objectives. Lead cross-functional governance forums and ensure policy integration with HR, Legal, and IT service management.
Risk Management &amp; Control Frameworks - Own the Information Security Risk Management Framework (ISRMF): including identification, assessment, prioritization, treatment, and monitoring of security risks. Implement risk quantification models and dashboards (e.g., FAIR, GRC platforms). Embed risk management into project governance, third-party onboarding, and change management.
Regulatory Compliance &amp; Audit Readiness - Ensure compliance with global and regional security and privacy regulations including: UAE PDPL, KSA PDPL, EU GDPR, PCI-DSS, ISO 27001/22301. Lead internal and external audits, including Group ISO certification efforts, customer security reviews, and regulatory inspections. Maintain audit evidence repository and collaborate with Internal Audit and Legal for closure of issues and recommendations.
Third-Party Risk Management - Own the end-to-end Third-Party Cybersecurity Risk Management (TPCRM) program. Define onboarding requirements, due diligence controls, contract clauses, and periodic reassessments. Collaborate with Procurement and Legal to ensure security risks are addressed during partner lifecycle.
Awareness &amp; Training - Lead cybersecurity awareness and compliance education programs across the Group, including campaigns, simulated phishing, and executive training. Customize programs for different roles, departments, and markets to increase engagement and accountability.
GRC Technology &amp; Automation - Manage the Group&rsquo;s GRC platform. Integrate GRC systems with ITSM, Risk Registers, and Incident Management platforms. Continuously improve metrics, dashboards, and workflow automation for GRC lifecycle efficiency.
What You&rsquo;ll Need To Succeed
<ul><li>Bachelor&rsquo;s or Master&rsquo;s degree in Cybersecurity, Information Assurance, Law, Risk Management, or a related field.
</li><li>Relevant certifications strongly preferred: CISM, CRISC, CGEIT, CISSP, ISO 27001 Lead Auditor, ITIL, or equivalent.
</li><li>12+ years of progressive experience in cybersecurity or technology risk, with 5+ years in a senior GRC leadership role in a global enterprise or regional conglomerate.
</li><li>Strong understanding of Middle East regulatory requirements and global data protection laws.
</li><li>Proven track record managing multi-audit environments, cross-border compliance, and stakeholder engagement at C-level.</li></ul>
What We Can Offer You
With us, you will turn your aspirations into reality. We will help shape your journey through enriching experiences, learning and development opportunities and exposure to different assignments within your role or through internal mobility. Our Group offers diverse career paths for those who are extraordinary, every day.
We recognise the value that you bring, and we strive to provide a competitive benefits package which includes health care, child education contribution, remote and flexible working policies as well as exclusive employee discounts.
We Invite All Applicants to Apply
It Takes Diversity Of Thought, Culture, Background, Differing Abilities and Perspectives to truly Inspire, Exhilarate and Delight our customers. At Chalhoub Group, we are committed to inclusion and diversity.
We welcome all applicants to apply and be part of our exciting future. We ensure equal opportunity for all our applicants without regard to gender, age, race, religion, national origin or disability status.</div>

Director of Information Security - GRC (Governance, Risk & Compliance)

Genesee County MI

<div>
 
 Salary: $56.7288 Hourly ($117,996)
 
 
 
 
 Minimum Qualifications
 
 
 
 Ten (10) years' progressive professional IT experience
 
 -AND-
 
 five (5) years' professional experience in cybersecurity, including leadership responsibilities
 
 -AND-
 
 five (5) years' experience in enterprise risk management, security auditing and compliance oversight
 
 -AND-
 
 five (5) years' experience supervising or managing IT and/or cybersecurity staff.
 
 
 Equivalent combinations of education and experience may be considered.
 
 
 
 Desired Certifications
 
 
 
 Experience in public sector or governmental environments preferred.
 
 
 Certified Information Systems Security Professional (CISSP)
 
 
 Certified Information Security Manager (CISM)
 
 
 Certified Information Systems Auditor (CISA)
 
 
 Certified in Risk and Information Systems Control (CRISC)
 
 
 GIAC certifications
 
 
 Other relevant advanced cybersecurity certifications
 
 
 
 Special Requirements
 
 
 
 Must be willing to work irregular hours, nights and weekends in response to cybersecurity incidents.
 
 
 Must obtain and maintain certifications as determined by the CIO.
 
 
 Will be required to pass background and security clearance checks.
 
 
 
 Physical Requirements
 
 
 
 Must be able to perform Essential Job Duties and Functions with or without reasonable accommodations.
 
 
 
 Job Summary
 
 
 
 The Chief Information Security Officer (CISO) is responsible for establishing, leading and continuously improving Genesee County's enterprise information security and risk management program. This executive leadership role provides strategic direction and governance for cybersecurity, data protection, regulatory compliance, business continuity and technology risk management across all County departments and offices.
 
 
 The CISO develops and implements a comprehensive, county-wide security strategy aligned with business objectives, legal requirements and industry best practices. The position is appointed by and reports to the Chief Information Officer and works closely with County leadership, elected officials, department heads and external partners.
 
 
 
 Essential Job Duties And Functions
 
 
 
 
 Strategic Leadership &amp; Governance
 
 
 
 <ul>
 <li>
 Develops and executes a comprehensive enterprise cybersecurity strategy and roadmap.
 </li>
 <li>
 Establishes a county-wide information security governance framework.
 </li>
 <li>
 Advises the CIO, County leadership and elected officials on cybersecurity risks, threats and mitigation strategies.
 </li>
 <li>
 Provides executive-level reporting on risk posture, security incidents, compliance status and emerging threats.
 </li>
 <li>
 Leads the development of long-term cybersecurity investment and budget planning.
 
 
 </li>
 </ul>
 
 Risk Management &amp; Compliance
 
 
 
 <ul>
 <li>
 Establishes and maintains a formal enterprise risk management framework for cybersecurity.
 </li>
 <li>
 Oversees security audits, risk assessments and vulnerability management programs.
 </li>
 <li>
 Ensures compliance with applicable federal, state and local regulations and standards.
 </li>
 <li>
 Develops, maintains and enforces information security policies, standards and procedures.
 </li>
 <li>
 Coordinates third-party risk management and vendor security reviews.
 
 
 </li>
 </ul>
 
 Security Architecture &amp; Operations
 
 
 
 <ul>
 <li>
 Provides executive oversight of county IT architecture, infrastructure security and data protection strategies.
 </li>
 <li>
 Ensures security measures are integrated into system design, development, procurement and implementation processes.
 </li>
 <li>
 Oversees implementation and management of security technologies including firewalls, VPNs, endpoint protection, identity and access management and data loss prevention.
 </li>
 <li>
 Ensures appropriate security controls are embedded in new systems, networks and data center initiatives.
 
 
 </li>
 </ul>
 
 Incident Response &amp; Resilience
 
 
 
 <ul>
 <li>
 Leads the County's cybersecurity incident response program.
 </li>
 <li>
 Directs response efforts for security breaches, threats and cyber incidents.
 </li>
 <li>
 Oversees development and testing of disaster recovery and business continuity plans.
 </li>
 <li>
 Coordinates with law enforcement, regulatory bodies, insurance carriers and external cybersecurity partners as needed.
 
 
 </li>
 </ul>
 
 Program &amp; Operational Management
 
 
 
 <ul>
 <li>
 Ensures the internal IT security framework operates effectively while supporting business needs across departments.
 </li>
 <li>
 Evaluates new initiatives and projects for security architecture alignment and risk mitigation.
 </li>
 <li>
 Leads security-related change management and stakeholder education initiatives.
 </li>
 <li>
 Establishes cybersecurity awareness and training programs for all County employees.
 </li>
 <li>
 Develops and tracks key performance indicators (KPIs) and key risk indicators (KRIs) for cybersecurity performance.
 
 
 </li>
 </ul>
 
 Leadership &amp; Supervision
 
 
 
 <ul>
 <li>
 Builds and leads a high-performing cybersecurity team.
 </li>
 <li>
 Fosters a culture of security awareness and accountability across the organization.
 </li>
 <li>
 Works collaboratively with department leadership to balance security, usability and operational efficiency.
 
 
 </li>
 </ul>
 
 Please See The Attached Job Description For More Details.
 
 
 
 
 
 Job Posted by ApplicantPro
 
 
</div>

CHIEF INFORMATION SECURITY OFFICER (IT)

Shake Shack

Our secret to leading the way in hospitality? We put our people first!
 At Shake Shack, our mission is to Stand For Something Good in all that we do. From our teams to our neighborhoods, we're committed to always doing the right thing. As one of the fastest-growing hospitality brands, we're all about crafting unforgettable experiences for our guests. We offer endless learning opportunities and the chance to make a lasting impact on our business, restaurants, and communities. As a member of the #ShackFam, you’ll have access to hands-on mentorship, training, and growth potential, all in a fun and inclusive environment.
 
Join us and Be a Part of Something Good.
 
The Senior Director, Information Security is Shake Shack’s senior enterprise security leader, accountable for protecting corporate systems, restaurant technology, and guest and employee data. Reporting to the VP Infrastructure and Operations, this role owns the company’s information security, cybersecurity, risk, and compliance programs, enabling business growth through trust, resilience, and strong governance.
 Core Responsibilities
 Security Strategy & Leadership
 Own enterprise security strategy, roadmap, and execution across cybersecurity, identity and access management, data protection, monitoring, and compliance.
 Serve as primary decision-maker for security risk prioritization, exceptions, and trade-offs impacting corporate and restaurant operations.
 Translate technical risk into clear, executive-level business impact.
 Regulatory, Compliance & Audit
 Executive lead for PCI DSS, SOX IT controls, privacy, and security governance.
 Ensure continuous audit readiness, remediation tracking, and policy enforcement.
 Security Operations & Incident Response
 Provide executive oversight of the SOC, incident response, and threat monitoring.
 Act as decision authority during high-severity incidents and lead post-incident reviews.
 Resilience, DR & BCP
 Oversee disaster recovery, business continuity, and enterprise resilience planning.
 Ensure secure, standardized infrastructure and cloud deployments.
 Third-Party & Vendor Risk
 Own vendor security risk management, assessments, monitoring, and executive escalation.
 Manage MSSPs and strategic security vendors with budget accountability.
 Qualifications
 12+ years in information security leadership.
 Deep experience with PCI, SOX, privacy, third-party risk, and incident response.
 Strong executive presence with experience advising senior leadership and Boards.
 
Benefits at Shake Shack: 
A work environment where you can come as you are, share your ideas, have fun, and work collaboratively:
 
Weekly Pay and Performance bonuses
 
Shake Shack Meal Discounts
 
Exclusive corporate discounts for travel, electronics, wellness, leisure activities and more
 
Medical, Dental, and Vision Insurance*
 
Employer Paid Life and Disability Insurance*
 
401k Plan with Company Match*
 
Paid Time Off*
 
Paid Parental Leave*
 
Access to Employee Assistance Program on Day 1
 
Pre-Tax Commuter and Parking Benefits
 
Flexible Spending and Dependent Care Accounts*
 
Development and Growth Opportunities
 
<ul>
<li>Eligibility criteria applies</li>
</ul>
Click the " Apply " button above to apply for this opening.
 
About Us
 Beginning as a hot dog cart in New York City’s Madison Square Park, Shake Shack was created by Danny Meyer, Founder and CEO of Union Square Hospitality Group and best-selling author of Setting the Table. Shack Fans lined up daily, making the cart a resounding success, and donating all proceeds back to the park beautification efforts. A permanent stand was eventually built…and the rest is Shack history! With our roots in fine dining and giving back to the community, we are committed to high quality food served with a high level of hospitality. Our team members enjoy a positive work environment that is deeply committed to the philosophy that we "Stand for Something Good."
 
Shake Shack is an Equal Opportunity Employer
 All qualified applicants will receive consideration for employment without regard to any protected characteristic, including race, color, ancestry, national origin, religion, creed, age, disability (mental and physical), sex, gender identity, sexual orientation, gender expression, medical condition, genetic information, marital, military and veteran status.

Senior Director, Information Security

KPMG

<div>The KPMG Advisory practice is at the forefront of transformation, offering excellent opportunities for individuals to advance their careers and expertise with KPMG. Looking ahead, we anticipate continued evolution and success within the practice, fostering both personal and professional development, thereby creating new pathways for growth. In this ever-changing market environment, our professionals must be adaptable and thrive in a collaborative, team-driven culture. At KPMG, our people are our number one priority. With a wealth of learning and career development opportunities, a world-class training facility, and leading market tools, we help our people continue to grow both professionally and personally. If you're looking for a firm with a strong team connection where you can be your whole self, have an impact, advance your skills, deepen your experiences, and have the flexibility and access to constantly find new areas of inspiration and expand your capabilities, then consider a career in Advisory.
<div>KPMG is currently seeking a Specialist Director, Managed Security Testing to join our Managed Services practice.</div><div>
Responsibilities:</div><div><ul><li>
Lead the strategic delivery of Managed Security Testing (MST) services, ensuring alignment with client objectives and industry best practices</li><li>
Develop and execute go-to-market (GTM) strategies for MST offerings, collaborating with cross-functional teams to drive market penetration and revenue growth</li><li>
Oversee the design and implementation of scalable security testing frameworks across diverse environments, including cloud-native and hybrid architectures</li><li>
Provide subject matter expertise in security testing of all varieties, guiding clients through risk assessments, remediation planning, and secure development lifecycle integration</li><li>
Build and maintain strong client relationships, serving as a trusted advisor and ensuring high levels of satisfaction and retention; mentor and lead a team of security professionals, fostering a culture of innovation, accountability, and continuous improvement</li><li>
Financial management and accountability of engagement delivery, acting as a point of escalation for client issues and owning profitability of delivery for engagements overseen</li><li>
Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment</li></ul></div><div></div><div> 
Qualifications:</div><div><ul><li>
Minimum eight years of recent experience in offensive security, social engineering, red/purple teaming, penetration testing, or related cybersecurity domains, with at least three years in a leadership or director-level role</li><li>
Master's degree from an accredited college or university in cybersecurity, computer science, or related field is preferred; Bachelor's degree from an accredited college or university is required</li><li>
Deep understanding of security testing methodologies, tools and best practices pertaining to offensive security including regulatory obligations</li><li>
Proven experience developing and executing GTM strategies for security services or technology solutions</li><li>
Strong client-facing skills with the ability to communicate complex technical concepts to non-technical stakeholders</li><li>
Excellent verbal/written communication, presentation, and analytical skills</li><li>
Ability to travel as required</li><li>
Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)</li></ul></div> 
<div></div>
<div>KPMG LLP and its affiliates and subsidiaries (&ldquo;KPMG&rdquo;) complies with all local/state regulations regarding displaying salary ranges. If required, the ranges displayed below or via the URL below are specifically for those potential hires who will work in the location(s) listed. Any offered salary is determined based on relevant factors such as applicant's skills, job responsibilities, prior relevant experience, certain degrees and certifications and market considerations. In addition, KPMG is proud to offer a comprehensive, competitive benefits package, with options designed to help you make the best decisions for yourself, your family, and your lifestyle. Available benefits are based on eligibility. Our Total Rewards package includes a variety of medical and dental plans, vision coverage, disability and life insurance, 401(k) plans, and a robust suite of personal well-being benefits to support your mental health. Depending on job classification, standard work hours, and years of service, KPMG provides Personal Time Off per fiscal year. Additionally, each year KPMG publishes a calendar of holidays to be observed during the year and provides eligible employees two breaks each year where employees will not be required to use Personal Time Off; one is at year end and the other is around the July 4th holiday. Additional details about our benefits can be found towards the bottom of our KPMG US Careers site at Benefits &amp; How We Work.</div><div></div><div> 
Follow this link to obtain salary ranges by city outside of CA: 
</div>
https://kpmg.com/us/en/how-we-work/pay-transparency.html/?id=M105ADV_2_26 California Salary Range: $169005 - $370530
<div><div>KPMG offers a comprehensive compensation and benefits package. KPMG is an equal opportunity employer. KPMG complies with all applicable federal, state and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, citizenship status, disability, protected veteran status, or any other category protected by applicable federal, state or local laws. The attached link contains further information regarding KPMG's compliance with federal, state and local recruitment and hiring laws. No phone calls or agencies please.</div><div></div><div> 
KPMG recruits on a rolling basis. Candidates are considered as they apply, until the opportunity is filled. Candidates are encouraged to apply expeditiously to any role(s) for which they are qualified that is also of interest to them.</div><div></div><div> 
Los Angeles County applicants: Material job duties for this position are listed above. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness, and safeguard business operations and company reputation. Pursuant to the California Fair Chance Act, Los Angeles County Fair Chance Ordinance for Employers, Fair Chance Initiative for Hiring Ordinance, and San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.</div></div></div>

Specialist Director, Managed Security Testing

Grant Thornton

<div>Grant Thornton is seeking a Director of Cyber Risk Operations to join the team. Approved office locations can be found below.
We are seeking a Director of Cyber Risk Operations to design, build, and lead a global Cyber Risk Operations Center (ROC). This role will own the continuous identification, assessment, prioritization, and management of technology and infrastructure risk across the enterprise.
The ideal candidate brings deep hands-on technical expertise, strong risk judgment, and the ability to operationalize cyber risk at scale&mdash;translating technical exposures into actionable, business-aligned risk insights. This leader will work closely with infrastructure, cloud, engineering, IAM, compliance, and third-party stakeholders globally.
Key Responsibilities
Cyber Risk Operations &amp; Strategy
<ul><li>Design and stand up a global Cyber Risk Operations Center (ROC), including operating model, workflows, tooling integration, metrics, and governance.
</li><li>Define and operationalize a consistent framework for identifying, prioritizing, tracking, and remediating cyber and infrastructure risk.
</li><li>Partner with security architecture, infrastructure, cloud, and application teams to embed risk management into day-to-day operations.
</li></ul>Technology &amp; Infrastructure Risk Management
<ul><li>Own enterprise technology risk visibility across on-prem, cloud, hybrid, and SaaS environments.
</li><li>Lead risk assessment and exception management processes, including risk acceptance, compensating controls, and executive-level risk reporting.
</li><li>Drive secure configuration assessment and risk management aligned to industry standards (CIS, NIST, Microsoft benchmarks, etc.).
</li></ul>Cloud Exposure &amp; Attack Surface Management
<ul><li>Oversee cloud security posture, exposure management, and attack path analysis across Azure and multi-cloud environments.
</li><li>Leverage tools such as Wiz, Azure Security Center / Defender, and related platforms to identify toxic combinations, misconfigurations, and high-risk attack paths.
</li><li>Partner with cloud engineering teams to prioritize remediation based on risk and business impact.
</li></ul>Vulnerability &amp; Endpoint Risk
<ul><li>Lead vulnerability management and endpoint exposure programs using tools such as Qualys and CrowdStrike.
</li><li>Ensure risk-based prioritization of vulnerabilities beyond CVSS, incorporating exploitability, asset criticality, and exposure.
</li></ul>Identity &amp; Access Risk
<ul><li>Oversee identity-related risk management, including privileged access, misconfigurations, and conditional access gaps using Microsoft Entra ID and related tooling.
</li><li>Partner with IAM teams to reduce identity-driven attack paths and enforce least privilege at scale.
</li></ul>Third-Party Risk Management
<ul><li>Own the cyber risk aspects of third-party and supply chain risk, including technology assessments, ongoing monitoring, and issue remediation.
</li><li>Integrate third-party risk insights into enterprise risk reporting and decision-making.
</li></ul>Leadership &amp; Stakeholder Engagement
<ul><li>Build and lead a high-performing, globally distributed team of cyber risk professionals.
</li><li>Communicate complex technical risk clearly to executives, auditors, and non-technical stakeholders.
</li><li>Provide regular risk posture updates to senior leadership, including trends, systemic issues, and material risks.
</li></ul>Required Qualifications
<ul><li>12+ years of experience in cybersecurity, infrastructure security, or technology risk, with 5+ years in senior leadership roles.
</li><li>Deep technical background in enterprise infrastructure, cloud platforms (especially Azure), identity systems, and security architecture.
</li><li>Hands-on experience with tools such as Qualys, CrowdStrike, Wiz, Azure Security/Defender, and Microsoft Entra ID .
</li><li>Proven experience building or scaling cyber risk, vulnerability management, or exposure management programs.
</li><li>Strong understanding of cyber risk frameworks (NIST CSF, NIST 800-53, ISO 27001, CIS).
</li><li>Demonstrated ability to translate technical findings into business-relevant risk decisions.
</li></ul>Preferred Qualifications
<ul><li>Experience standing up a centralized risk operations or exposure management function.
</li><li>Background in highly regulated or global enterprise environments.
</li><li>Familiarity with SOC 2, cloud compliance, and audit-driven risk management.
</li>Relevant certifications (CISSP, CISM, CCSP, CRISC, or equivalent). 
<li>
</li></ul>The base salary range for this position in the firm&rsquo;s Chicago, IL, Downers Grove, IL, Cleveland, OH, Minneapolis, MN, Reno, NV, Denver, CO and Baltimore, MD offices only is between $187,500 and $312,500 per year.
The base salary range for this position in the firm&rsquo;s Washington, DC, Boston, MA, Bellevue, WA, Los Angeles, CA, Newport Beach, CA San Diego, CA, Edison, NJ, and New York, NY, and Melville, NY offices only is between $202,500 and $337,500 per year.
The base salary range for this position in the firm&rsquo;s San Francisco, CA and San Jose, CA offices only is between $215,625 and $359,375.</div>

Director, Cyber Risk Operations (Global ROC)

Search 8593+ Cybersecurity director jobs near you this March. New roles added regularly across leading industries. Apply today.