KEY RESPONSIBILITIES

Enterprise Security Strategy, Governance and Leadership

• Own and maintain a multi-year enterprise cybersecurity strategy, operating model, roadmap, and investment plan aligned with business objectives, enterprise risk appetite, legal obligations, client commitments, and the evolving threat landscape.
• Lead cybersecurity governance and provide concise, decision-ready reporting to executive leadership and the Board on risk posture, incidents, control effectiveness, program maturity, investment needs, and remediation progress.
• Define clear accountability across the three lines model; establish enterprise security policies, standards, control objectives, exceptions, and risk acceptance processes with documented business ownership.
• Build, lead, develop, and retain a high-performing security organization; define roles, succession plans, performance measures, and strategic sourcing models for internal and managed security capabilities.
• Manage the cybersecurity operating and capital budgets, workforce plan, technology portfolio, and third-party services to optimize risk reduction and business value.

Cyber Risk, Compliance and Federal Contracting

• Own the enterprise cyber risk management framework and maintain consistent methods for identifying, assessing, prioritizing, treating, accepting, monitoring, and reporting information security risk.
• Partnering with Director of Federal Compliance, provide executive oversight for federal cybersecurity compliance, including FCI and CUI scoping, shared-responsibility models, evidence retention, continuous monitoring, and assessment readiness.
• Oversee implementation and sustainment of applicable requirements under CMMC, NIST SP 800-171 and related assessment objectives, DFARS cybersecurity clauses, FAR safeguarding requirements, governance for Systems Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), assessment results and contractual incident-reporting and information-protection obligations.
• Partner with Legal, Contracts, Procurement, Compliance, and business leaders to review solicitations and contract language, determine security obligations, flow down requirements to subcontractors, and prevent unsupported representations of compliance.
• Coordinate internal assessments, independent reviews, customer inquiries, regulator interactions, and CMMC assessment preparation; ensure findings are risk-ranked, assigned, funded, tracked, and validated to closure.
• Maintain alignment with other applicable frameworks and obligations such as the NIST Cybersecurity Framework, NIST SP 800-53, ISO/IEC 27001, privacy requirements, state breach-notification laws, and client-specific requirements.

Security Architecture, Cloud and DevSecOps

• Establish enterprise security architecture principles and reference architectures for identity, endpoint, network, cloud, data, application, API, operational technology, and third-party connectivity.
• Act as executive sponsor for DevSecOps and secure software development lifecycle practices that integrate security into product and solution planning, architecture, coding, build, test, release, deployment, and operations.
• Require risk-based security gates and automated controls in CI/CD pipelines, including source-code and dependency scanning, secrets detection, software composition analysis, infrastructure-as-code scanning, container and artifact assurance, and security testing appropriate to the technology and risk.
• Ensure engineering teams apply threat modeling, secure coding standards, code review, least privilege, environment segregation, change control, vulnerability remediation, logging, and security acceptance criteria.
• Define governance for software supply-chain risk, open-source use, code provenance, artifact integrity, software bills of materials when required, third-party components, and secure release practices.
• Partner with technology and engineering leaders to create reusable security patterns, paved roads, guardrails, and metrics that improve developer experience while reducing risk and delivery friction.
• Provide security governance for cloud platforms, Infrastructure as Code, APIs, low-code/no-code platforms, citizen development, artificial intelligence, and machine learning use cases.

Security Operations, Incident Response and Resilience

• Oversee security monitoring, detection engineering, threat intelligence, vulnerability and exposure management, penetration testing, identity threat protection, endpoint security, email security, data protection, and security operations center capabilities.
• Maintain an enterprise cyber incident response program with defined severity criteria, decision rights, communications, legal and regulatory coordination, evidence preservation, customer notification support, and executive escalation.
• Lead or coordinate response to material cyber incidents and ensure after-action reviews result in measurable corrective actions.
• Partner with business continuity, disaster recovery, crisis management, and operational leaders to validate recovery strategies, ransomware resilience, backup protection, and exercises for high-impact scenarios.
• Develop measurable key risk and performance indicators that demonstrate control effectiveness, remediation velocity, resilience, and business impact rather than activity alone.

Data Protection, Third-Party Risk and Workforce Security

• Establish security requirements for data classification, handling, retention, encryption, loss prevention, access governance, records protection, and secure disposal in partnership with Legal, Privacy, and data owners.
• Oversee cybersecurity due diligence and lifecycle risk management for suppliers, software providers, cloud services, managed service providers, subcontractors, and other third parties.
• Ensure security requirements are incorporated into procurement, contracts, onboarding, monitoring, renewal, and termination processes, including federal flow-down obligations when applicable.
• Lead enterprise security awareness, role-based training, phishing resilience, executive education, and privileged-user training programs; reinforce a culture of shared accountability for security.
• Coordinate insider-risk, personnel-security, physical-security, and workplace-safety interfaces with Human Resources, Legal, Facilities, and business leadership.

POSITION COMPETENCIES

• Executive leadership and influence: translates complex cyber risk into business decisions and earns trust across technical, operational, legal, and executive audiences.
• Risk-based judgment: makes defensible decisions using evidence, business context, threat intelligence, materiality, and documented risk ownership.
• Strategic execution: converts strategy into funded roadmaps, accountable outcomes, measurable controls, and sustainable operating processes.
• Collaboration and enablement: partners with technology and business teams to implement secure solutions without unnecessary friction.
• Crisis leadership: communicates clearly, remains decisive under pressure, and coordinates cross-functional response to high-impact events.
• Financial and commercial acumen: connects cyber investments and contractual obligations to business value, loss avoidance, client trust, and growth.

EXPERIENCE AND ACADEMIC REQUIREMENTS

• 12 or more years of progressive experience in cybersecurity, technology risk, information technology, engineering, or related disciplines, including significant enterprise security leadership responsibility.
• 5 or more years leading managers, multidisciplinary security teams, or enterprise-wide security programs in a complex, distributed organization.
• Demonstrated experience advising executive leadership or a Board on material cyber risk, incidents, regulatory obligations, program maturity, and investment priorities.
• Demonstrated ownership of security strategy, governance, architecture, operations, incident response, third-party risk, vulnerability management, identity, data protection, and security awareness capabilities.
• Experience establishing or governing DevSecOps and secure SDLC practices across CI/CD pipelines, cloud platforms, application development, APIs, Infrastructure as Code, and software supply chains.
• Experience with federal contracting cybersecurity requirements, including CUI and FCI handling, NIST SP 800-171 implementation or assessment, DFARS cybersecurity obligations, CMMC scoping and readiness, SSPs, POA&Ms, evidence management, and supplier flow-downs.
• Experience managing budgets, vendors, managed services, workforce plans, and multi-year transformation roadmaps.
• Experience operating in a highly regulated, project-based, engineering, professional services, critical infrastructure, or similarly complex environment preferred.

• Working knowledge of modern enterprise architecture, cloud security, Zero Trust, identity and access management, data security, security operations, threat and vulnerability management, privacy-supporting controls, resilience, and secure software development.
• Ability to interpret laws, regulations, standards, contractual clauses, and customer requirements and translate them into practical governance, control, evidence, and accountability models.
• Ability to communicate technical and compliance issues in concise business language, including consequences, options, cost, and residual risk.

CERTIFICATIONS