Associate Director of Cybersecurity

FirstDay Foundation•San Antonio, TX

17h

About The Position

First Day Foundation is seeking an experienced, hands-on Associate Director of Cyber Security to help lead and mature cybersecurity operations across the foundation and its affiliated organizations. The role partners with the Director of Cyber Security, IT leadership, and business stakeholders to protect a diverse, mission-driven environment while enabling secure and efficient operations. The Associate Director provides operational leadership across security monitoring, incident response, vulnerability management, identity security, security engineering, and compliance. The role moves between strategic planning, technical investigation, and communication with technical and non-technical leaders. It serves as an operational bridge between executive priorities and the Cyber Security team’s daily execution by translating direction into priorities, assigning owners, tracking delivery, and escalating decisions and unresolved risks. The Associate Director is the Director of Cyber Security’s backup and right-hand partner, translates CISO priorities into execution through the Cyber Security Manager, and provides the CISO visibility into material risks and progress. The position also helps establish practical security governance for employee-built AI agents, automations, and AI-enabled workflows, working with Data Governance, application teams, and business owners on guardrails for identity, permissions, data handling, logging, human oversight, and change management. The role may participate in an on-call or incident-response rotation as needed.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent relevant experience may be considered in lieu of a degree.
Five or more years of progressive experience in cybersecurity, IT security, systems administration, cloud security, or a related technical discipline.
Three or more years of experience leading security operations, security projects, technical teams, or cross-functional security initiatives.
Strong experience with security operations and incident response, including detection triage, investigation, containment, recovery, and post-incident review.
Ability to translate security strategy into operational execution by setting priorities, assigning ownership, tracking actions, communicating status, and escalating unresolved decisions or risks.
Working knowledge of Microsoft security technologies, including Microsoft 365, Entra ID, Intune, Defender, Conditional Access, and Purview.
Experience with EDR/XDR, SIEM, vulnerability management, email security, network security, and cloud platforms such as AWS and Azure.
Experience with, or strong aptitude to rapidly develop proficiency in, managed detection and response operations, security-vendor management, endpoint and identity coverage assessment, and remediation coordination across decentralized teams.
Familiarity with security frameworks and regulatory requirements, including NIST CSF, CIS Controls, SOC 2, HIPAA, and FTC Safeguards Rule.
Ability to explain technical risks in terms of practical business impact and clear recommendations for executive leadership.
Strong written, verbal, organizational, and stakeholder-management skills.
Ability to work independently, manage competing priorities, and remain composed during security incidents.
Aptitude in emerging AI-agent and automation architectures, including identity, permissions, integrations, data flows, logging, and human-in-the-loop controls.
Sound judgment and a risk-based approach to decision-making; technical curiosity and ability to investigate complex issues.
Ability to balance security requirements with mission, operational, and user needs; demonstrate ownership, follow-through, and attention to detail.
Collaborative leadership and ability to influence without relying solely on direct authority.
High integrity and discretion when handling sensitive information.
Applicants must be authorized to work for any employer in the United States; visa sponsorship is not available.

Nice To Haves

Master’s degree in a related field.
Certifications such as CISSP, CISM, CRISC, GCIH, GCIA, Security+, CEH, CCSP, Microsoft SC-100, SC-200, AZ-500, AWS Security Specialty, or equivalent.
Experience supporting a nonprofit, healthcare, human-services, multi-entity, or similarly regulated environment.
Experience operating CrowdStrike Falcon Complete, Falcon Identity, Exposure Management, and/or CrowdStrike Next-Gen SIEM/LogScale, including vendor coordination, coverage assessment, alert and case review, and remediation tracking.
Experience with Microsoft Defender, Microsoft Purview, Fortinet, Salesforce, Workday, or similar enterprise platforms.
Experience building or improving a cybersecurity program in a distributed or multi-affiliate organization.
Experience managing MSSP, MDR, incident-response, or other security-vendor relationships.
Experience assessing or governing AI-enabled applications, agents, copilots, automations, APIs, or low-code integrations in an enterprise environment.

Responsibilities

Support the Director of Cyber Security in developing, implementing, and maintaining cybersecurity strategy, roadmaps, policies, standards, and operating procedures.
Lead day-to-day security operations across the foundation and affiliated organizations, including alert triage, investigations, incident coordination, and remediation follow-through.
Translate executive priorities and risk decisions into operating plans; assign ownership, track commitments and remediation, and escalate blockers, tradeoffs, and unresolved risk decisions.
Oversee and optimize security platforms, including endpoint detection and response, identity protection, SIEM/log management, Microsoft 365 security, cloud security, email security, and data protection controls.
Own the operational relationship with CrowdStrike Falcon Complete and related services; assess coverage, alert quality, escalations, and investigations; coordinate response; and track remediation actions to resolution.
Manage and mature incident response, including documentation, containment coordination, lessons learned, tabletop exercises, and executive reporting.
Drive vulnerability and exposure management by coordinating risk-based remediation with infrastructure, cloud, application, and affiliate IT teams.
Partner with Identity and Access Management teams to strengthen MFA, Conditional Access, privileged access, account lifecycle processes, and third-party access controls.
Manage security logging and detection engineering, including onboarding priority data sources, tuning detections, reducing false positives, and improving investigation workflows.
Establish and operate practical AI security governance for employee-built agents, automations, and AI-enabled workflows, maintaining visibility into their capabilities, access, and accountable owners.
Build technical understanding of AI agents, connectors, automations, and integrations; partner with Data Governance, application teams, and business owners to implement practical security guardrails.
Support third-party risk assessments, vendor security reviews, contract security requirements, and ongoing vendor-risk tracking.
Assist with compliance and assurance initiatives, including SOC 2, NIST Cybersecurity Framework, HIPAA, FTC Safeguards Rule, and other applicable obligations.
Develop leadership security metrics and reports covering incident trends, vulnerability remediation, endpoint coverage, phishing performance, identity risk, and program maturity.
Coordinate with affiliate IT leaders to implement security standards consistently while accounting for operational and local business requirements.
Help lead security awareness and phishing-training programs for employees and contractors.
Serve as an escalation point for complex technical security issues and mentor, guide, and provide quality assurance for security analysts and engineers.
Participate in an on-call or incident-response rotation as needed.