Director, Global Information Security

AmeriCares

2d•$137,319 - $150,900•Remote

About The Position

The Director, Global Information Security will own and advance information security across our globally distributed humanitarian organization operating in high-risk environments, building and advancing our information security program, deepening partnerships, and sharpening a cybersecurity culture to keep Americares safe, resilient, and trusted. With a technology footprint that spans country offices across multiple regions, a growing cloud and SaaS environment, and an expanding set of donor, partner, and beneficiary data obligations, Americares seeks dedicated, expert ownership of information security to operate responsibly at this scale. The Director, Global Information Security will play a critical role in leading the organization through a period of digital transformation, expanding the use of cloud platforms, data analytics, and AI-enabled tools across our global operations.

Requirements

CISM, CISSP, CySA+, Security+, or Microsoft security certifications such as SC-200 or SC-300
Influence and Functional Authority: Achieves security outcomes through people and teams who do not report to them. Builds credibility with peers in Infrastructure, Data Management, Enterprise Applications, Legal, and country operations. Sets clear expectations and holds others accountable through relationship and expertise rather than positional authority. Knows when to escalate to the VP and when to resolve laterally.
Security Judgment and Risk Communication: Translates complex and evolving cybersecurity risks into clear, actionable language for non-technical audiences including leadership, Legal, country directors, and program staff. Makes sound risk prioritization decisions under uncertainty and resource constraints. Knows what to escalate, what to absorb, and what to defer.
Program Building in a Resource-Constrained Environment: Has built or materially advanced a security program without a large team or budget. Comfortable doing hands-on work while simultaneously designing the governance structures, policies, and processes that others will eventually operate. Does not wait for perfect conditions. Understands security and data-protection considerations for AI-enabled tools and platforms; partners with the organization's AI governance effort to define security guardrails and requirements for AI tool adoption.
Vendor and Partner Oversight: Manages external security relationships (MDR, SOC, CIS, insurance company, consultants) with discipline. Knows what to expect from a managed service provider, how to hold them accountable, and when their output is insufficient. Has experience selecting and onboarding security vendors. Will demonstrate a high degree of professionalism and finesse as they work with a wide range of partner organizations who receive resources/funding on information security matters.
Global and Cross-Cultural Awareness: Has worked in or alongside organizations operating in multiple geographies, ideally in development, humanitarian, or health contexts. Understands that security controls that work at HQ may need to be adapted for low-bandwidth, high-risk, or resource-limited country office environments, as well as high-risk, politically sensitive, and emergency response operating environments, where practical implementation of security controls often requires additional flexibility.
Ownership and Resilience: Drives their focus area independently. Anticipates challenges, proposes solutions, and does not wait to be told what to do next. Approaches novel threats and organizational constraints with a growth mindset, modeling adaptability for the teams and partners they work with. Comfortable operating in ambiguity, especially during the program-building phase where not everything is defined yet.
Communication and Stakeholder Engagement: Communicates security posture, risks, and recommendations clearly to diverse audiences, including preparing board-level materials in partnership with the VP of IT; engages directly with senior stakeholders as needed. Facilitates alignment among stakeholders with competing priorities. Engages country office and department stakeholders in ways that build buy-in rather than resistance. Can represent Americares in peer communities like NetHope and NGO-ISAC.
US work authorization without restriction and 10% travel are required for this role.
Candidates must be currently living in and will continue to live in one of the following states/territories: CT, DC, FL, GA, IL, MD, MA, NC, NJ, NY, OR, PA, Puerto Rico, TN, TX, VA, or WA.

Nice To Haves

Fluency in languages that are spoken in at least one of our core locations (India, Philippines, Tanzania, El Salvador, Puerto Rico, Colombia, etc.), in addition to English

Responsibilities

Own and advance Americares global information security program, including policy development, governance frameworks, security standards, and cybersecurity culture across HQ and country office operations worldwide.
Lead and oversee all managed security services and vendor relationships, including MDR/SOC provider performance, endpoint protection, email security, CIS membership and assessments, and cyber insurance compliance, ensuring vendors are held accountable to clear standards and delivering measurable value.
Conduct and manage CIS-based security assessments, produce prioritized risk registers and remediation roadmaps, oversee vulnerability management including risk ranking, remediation tracking, and exception handling, and report progress against the security roadmap to leadership.
Own the cybersecurity incident response plan, including maintenance, tabletop exercises, staff training, and active coordination with internal teams, including Legal, Compliance and Risk Management (LCRM), Finance, Communications, and country offices during incidents, ensuring alignment with the organization's broader crisis management and business continuity processes.
Partner with Technology Operations, Data Management and Enterprise Applications, Legal Compliance and Risk Management, and Global Safety and Security to define, validate, and maintain security requirements across infrastructure, applications, identity, data, and physical security.
Oversee day-to-day security operations including SOC/MDR ticket review, escalation management, service quality oversight, identity and access control validation, and correlation of signals across endpoint, email, cloud, and network environments.
Represent Americares in peer security communities including NetHope and NGO-ISAC, serve as the internal subject matter expert on cybersecurity for leadership, and build a security-aware culture across a globally distributed workforce through awareness programs, policy socialization, and change management.
Actively model and contribute to Americares values, work culture and mission.
Engage in and contribute to team spaces with openness, global competencies, and a growth mindset.
Other duties and responsibilities as assigned.