​​Director, Cybersecurity and Risk

ASU Enterprise Partners • Scottsdale, AZ

23h • Hybrid

About The Position

The Director, Cybersecurity and Risk leads ASU Enterprise Partners’ security risk reduction efforts across enterprise platforms, third-party technology, and institutional initiatives. As the senior security and risk leader within Technology & Solutions, the role partners with Data Governance, OGC, systems and data teams, affiliates, and vendors to implement security expectations consistently across Microsoft, Google, Workday, Salesforce, and other critical systems. The position focuses on practical risk reduction, secure configuration, access governance, control maturity, data protection, and incident preparedness in partnership with operational technology owners.

The director owns and develops the security posture of enterprise SaaS and cloud platforms, access controls, secure configuration standards, data protection controls, monitoring and incident readiness, and vendor security reviews. The role leads technology risk and architecture reviews, supports audit readiness and remediation, and communicates risk, control effectiveness, exposure, and progress through executive reporting and dashboards.

The director also leads and manages assigned security or risk-focused staff, supports security-related budgets and resource planning, and represents Technology & Solutions and ASU Enterprise Partners in security and technology risk discussions. ASU Enterprise Partners is a nonprofit organization supporting Arizona State University and its affiliates.

Requirements

• Bachelor’s degree in cybersecurity, information technology, risk management, information systems, or a closely related field, or an equivalent combination of education and experience.
• At least eight years of experience in information security, technology risk, security operations, IT risk management, or related technology leadership roles.
• At least four years of experience managing employees in a technical environment.
• Experience securing, governing, or assessing enterprise SaaS and cloud platforms such as Microsoft 365, Azure/Entra ID, Google Workspace/Cloud Identity, Workday, Salesforce, or comparable platforms.
• Experience with identity and access management, access governance, privileged access, secure configuration, tenant hardening, data protection, or SaaS governance.
• Experience working cross-functionally with technology, data, legal/procurement, governance/compliance, business, and vendor stakeholders.
• Experience implementing security controls, managing remediation, conducting security reviews, or supporting audit and evidence activities.
• Experience with vendor security reviews, incident response coordination, and security risk communication.
• Strong understanding of security risk management, security controls, incident response readiness, vendor security, identity and access governance, data protection, and modern enterprise technology environments.
• Ability to evaluate information security risk for new initiatives and recommend practical mitigation strategies.
• Ability to define secure configuration expectations, access control requirements, monitoring needs, and remediation plans for enterprise platforms.
• Working knowledge of Microsoft 365, Azure/Entra ID, Google Workspace/Cloud Identity, Workday, Salesforce, identity and access management, endpoint protection, SaaS governance, cloud security concepts, and data protection practices.
• Ability to maintain confidentiality and responsibility regarding sensitive organizational, university, constituent, employee, and financial information.
• Ability to communicate clearly with technical and non-technical audiences, including executive, legal/procurement, governance/compliance, business, and vendor stakeholders.
• Strong project management, reporting, documentation, and stakeholder communication skills.
• Ability to develop executive-ready summaries, remediation dashboards, risk narratives, procedures, standards, and implementation guidance.
• Ability to work independently and as part of a team.
• Team-oriented strategist able to manage complex situations involving numerous and sometimes competing constituencies.
• Strong knowledge of process and quality improvement.
• Ability to represent the institution well.
• Commitment to ASU Enterprise Partners’ mission and ASU’s vision as the New American University.
• Attention to detail and thoroughness in completing assigned duties.
• Highly organized and able to handle multiple projects.
• Adept at navigating complex environments with evolving priorities and communication plans.
• Equivalent combinations of experience and/or education may be considered where they provide comparable knowledge, skills, and abilities.

Nice To Haves

• Advanced degree in cybersecurity, information systems, risk management, business, privacy, or a related field.
• Experience in higher education, nonprofit, SaaS/cloud, privacy-sensitive, financial, fundraising, or regulated environments.
• Experience supporting SOC 2, NIST CSF, CIS Controls, internal controls, external assessments, or audit evidence activities.
• Experience developing security procedures, security standards, control implementation guidance, risk summaries, or stakeholder-facing security materials.
• Experience defining security monitoring and logging requirements.
• Experience coordinating access recertifications, privileged access reviews, service account reviews, platform hardening initiatives, or SaaS security posture assessments.
• Relevant certifications such as CISSP, CISM, CISA, CRISC, Security+, Microsoft Security, Azure Security, Google Cloud Security, or similar security/risk credentials.
• Willingness to complete relevant Microsoft, Google, cloud security, security operations, or risk-related certifications as appropriate to the role.

Responsibilities

• Lead security risk reduction across systems, vendors, processes, and technology initiatives.
• Implement and operationalize security controls with infrastructure, identity, endpoint, data, application, and business teams.
• Support security control alignment, audit readiness, remediation tracking, and evidence collection with governance and compliance stakeholders.
• Track remediation efforts, identify owners, communicate status, and escalate unresolved risks through appropriate channels.
• Translate security risks, technical issues, and control gaps into clear business impacts for technical and non-technical audiences.
• Develop, update, and maintain security procedures, standards, implementation guidance, and operational documentation.
• Own and mature security posture for enterprise SaaS and cloud platforms, including Microsoft 365, Azure/Entra ID, Google Workspace/Cloud, Workday, Salesforce, and other business-critical applications.
• Lead oversight of identity and access controls, including MFA, conditional access, SSO, SAML, OAuth, privileged access, role-based access, service accounts, access reviews, and joiner/mover/leaver processes.
• Establish secure configuration standards and review processes, including tenant hardening, administrative role governance, external sharing controls, audit logging, data protection settings, and integration/API security.
• Partner with platform, infrastructure, identity, endpoint, cloud, SaaS, data, and application teams to implement controls consistently.
• Participate in design, access, release-readiness, and control reviews when security or risk considerations are relevant.
• Partner with data owners and platform teams to implement data classification, DLP, secure sharing, access monitoring, retention-aligned safeguards, and protection of sensitive information.
• Define logging, monitoring, alerting, and evidence requirements for enterprise platforms and work with operational teams to establish detection and response capabilities.
• Maintain information-flow and risk documentation and safeguards for organizational, subsidiary, university, donor, prospect, and business-sensitive information.
• Support incident response readiness, including maintaining response plans, participating in tabletops, documenting and escalating incidents, and driving post-incident improvements.
• Coordinate with Technology & Solutions, governance/compliance, legal, communications, business units, vendors, and leadership during security incidents as appropriate.
• Manage vendor security reviews, including questionnaires, documentation review, risk identification, and mitigation recommendations.
• Partner with legal, finance, governance, and compliance stakeholders on vendor security requirements, contract considerations, data protection expectations, and remediation commitments.
• Lead security architecture and risk reviews for technology purchases, integrations, platform changes, data initiatives, SaaS implementations, and business process changes; document, mitigate, or escalate risks.
• Engage business units to understand initiatives, identify security risks, and recommend practical mitigations.
• Lead and participate in projects involving information security, security awareness, continuity planning, IT policies, control improvement, and risk mitigation.
• Develop security risk metrics, executive-ready reporting, remediation dashboards, and maturity updates on control effectiveness, exposure, and progress.
• Lead and manage assigned security or risk-focused staff, including hiring, coaching, mentoring, prioritization, performance development, training, and accountability.
• Articulate deliverables, objectives, outcomes, milestones, and timelines for security and risk initiatives.
• Represent Technology & Solutions and ASU Enterprise Partners professionally in discussions involving security, technology risk, vendor security, and institutional trust.
• Support planning and management of security-related budgets, vendor spending, and resource needs.

Benefits

• Hybrid work schedule, with work from home two days a week.
• Comprehensive benefits package, including medical, dental, and vision insurance.
• 401(k) plan with matching employer contribution.
• 22 days of vacation time.
• 11 holidays, including the employee’s birthday.
• Parental leave.
• Significant tuition reductions.
• Professional development and opportunities to explore new areas of interest across the organization.
• $30 bi-weekly cell phone reimbursement.

What This Job Offers

• Job Type: Full-time
• Career Level: Director