Chief Information Security Officer

Tract Capital Management•Denver, CO

About The Position

The Chief Information Security Officer (CISO) is a senior leadership role responsible for establishing, maturing, and governing the enterprise information security program across Tract Capital Management and its investment strategies, Tract and Fleet Data Centers. Reporting directly to the CITO, the CISO owns information security governance, compliance, risk management, and controls to meet the needs of institutional investors, hyperscale customers, regulatory bodies, and the organization’s fiduciary obligations. This hands-on leadership role requires experience building security programs within complex, multi-entity investment structures and working across corporate IT, operational technology (OT), and third-party ecosystems to deliver a unified governance model that scales with the company’s growth. The CISO leads the enterprise Information Security Management System (ISMS), security policy framework, compliance program, and security controls. The role also oversees third-party risk, identity and access governance, data protection, insider risk, incident response, disaster recovery, business continuity, and security awareness. The CISO works closely with executive leadership, Legal, Finance, Investor Relations, IT, Fleet’s physical and OT security leadership, hyperscaler customers, and external assessors, and represents the organization’s security posture in investor operational due diligence and customer reviews.

Requirements

Bachelor’s degree in Information Security, Computer Science, Engineering, or a related field.
10+ years of progressive information security experience, including at least 5 years in a CISO, Deputy CISO, or equivalent senior security leadership role.
Demonstrated experience building and maturing information security programs in private equity, asset management, or financial services environments with multi-entity or multi-fund structures.
Deep working knowledge of ISO 27001, NIST 800-53, and SOC 2 Type II, with demonstrated experience leading organizations through certification and audit processes.
Expert-level understanding of GDPR and CCPA and their application to investment management firms with cross-border operations.
Hands-on experience with the Microsoft 365 security and compliance stack, including Entra ID, Defender XDR, Purview, Intune, and Conditional Access.
Strong background in third-party risk management and vendor security assessment programs.
Experience planning and executing incident response and post-incident reporting where investor and regulatory notification obligations apply.
Proven ability to communicate security posture and risk to executive leadership, boards, and institutional investors, including through investor ODD/DDQ processes.
Ability to translate business strategy and growth into a scalable security program.
Ability to work across distinct legal entities with different risk profiles, regulatory postures, and operational models under unified governance.
Experience communicating security posture and controls to institutional investors during due diligence.
Willingness to operate at both strategic and tactical levels as the security function matures and scales.
Ability to influence outcomes across business units and collaborate with Legal, Finance, Operations, and Engineering stakeholders.

Nice To Haves

Experience with critical infrastructure security, including OT/ICS environments such as data centers, utilities, or industrial settings.
Familiarity with ISO 42001 or demonstrated experience establishing AI governance frameworks.
Experience supporting SEC-registered or SEC-exempt investment advisers and understanding related compliance obligations.
Knowledge of REIT structures, fund accounting controls, and security considerations unique to real estate private equity.
Experience with FedRAMP requirements as they relate to customer contractual obligations.
Advanced degree such as an MBA, MS in Cybersecurity, or equivalent.
Active CISSP, CISM, CISA, CRISC, or equivalent certification.

Responsibilities

Design and lead the enterprise-wide Information Security Management System aligned to ISO/IEC 27001 and NIST 800-53 across corporate IT and OT environments and all entities.
Establish and chair an Information Security Governance Committee representing TCM, Tract, and Fleet Data Centers, integrated with the existing risk committee structure.
Own the information security policy framework across entities, including acceptable use, AI, access control, data classification and handling, incident response, and supporting Fleet policies.
Drive adoption and operationalization of ISO 27001 certification and ISO 42001 across appropriate entities.
Present security posture, risk exposure, and program maturity to the ELT Steering Committee, Risk Committees, and CITO on a regular cadence.
Represent the organization’s information security posture during investor operational due diligence, respond to DDQs and questionnaires, and support institutional investor reviews.
Build and operate the information security compliance program across TCM, Tract, and Fleet, accounting for each strategy’s regulatory and contractual obligations.
Maintain and improve alignment with ISO 27001, NIST 800-53, SOC 2 Type II, GDPR, CCPA, and customer-specific requirements, including hyperscaler contracts and FedRAMP where applicable.
Own compliance posture scoring using Microsoft Purview Compliance Manager and equivalent tools, mapping internal controls to required frameworks.
Partner with the CLO and outside counsel to align security practices with securities regulations, fiduciary obligations, fund LPA requirements, and data privacy legislation.
Manage relationships with Trace3 Security Solutions and other assessors conducting penetration tests, vulnerability assessments, and security audits using NIST 800-115, OWASP, and MITRE ATT&CK methodologies.
Ensure compliance with EU data protection requirements, including GDPR and Schrems II, as the organization expands its European investment footprint.
Define, implement, and monitor information security controls at enterprise and investment-strategy levels, tailoring controls to each entity’s risk profile.
Own the enterprise third-party and vendor risk management program, coordinating with the Technology Requirements Checklist and evaluating vendors across security and resilience controls.
Oversee data loss prevention, information classification, sensitivity labeling, and data governance controls to protect investor, financial, deal pipeline, design, and other confidential information.
Manage enterprise identity and access management governance with the IT team, including Entra ID Conditional Access, RBAC, SCIM lifecycle automation, and Privileged Identity Management.
Lead the Insider Risk Management program using Microsoft 365 security capabilities, including behavioral analytics for data exfiltration, IP theft, and policy violations.
Maintain and exercise incident response, disaster recovery, and business continuity plans, coordinating incident classification, escalation, and required investor or customer notifications.
Govern the KnowBe4 security awareness program, including phishing simulations, the Tract Capital Cyber Security Safety Guide, and new-hire security onboarding.
Partner with Fleet’s SVP of Physical, OT, & Cyber Security to align corporate IT governance with physical, OT, and cyber security operations at data center facilities.
Collaborate with the CFO and Finance organization on controls for fund accounting, capital calls, wire transfers, and investor portals.
Support the CITO in AI governance, ensuring approved AI tools operate within security and data governance guardrails and that the AI Policy is enforced.
Interface with hyperscaler customer security teams to meet contractual security requirements and support customer due diligence.
Work with Investor Relations to maintain DDQ-ready security documentation and provide timely, accurate responses to ODD questionnaires.