Director, IT Infrastructure and Security

MBX Biosciences•Burlington, MA

2h•Hybrid

About The Position

The Director, IT Infrastructure and Security is a hands-on leader responsible for the reliability, security, and scalability of the technology environment at MBX Biosciences. Reporting to the VP, IT, this role builds and scales IT operations in a regulated environment, owns execution of the cybersecurity program in partnership with the fractional CISO, helps lead security strategy and policy, and oversees cloud, network, and Tier 1 and Tier 2 service desk operations. The position combines strategic leadership with direct technical involvement and applies modern technologies, including generative and agentic AI, to strengthen security operations, improve risk insight, and increase IT efficiency. The Director will lead infrastructure and security planning as the company advances from clinical development toward commercial readiness. This includes protecting intellectual property, clinical data, and corporate data; preparing systems and processes for regulatory inspections and audits; supporting responsible AI governance; and managing infrastructure, operations, security roadmaps, budgets, and service providers. The role reports to the VP, IT and collaborates with the fractional CISO and teams across the business.

Requirements

Bachelor’s degree in IT, Computer Science, Cybersecurity, or a related field, or equivalent experience.
10 or more years of progressive experience in IT infrastructure, operations, and security, including at least 5 years in leadership.
Demonstrated experience building and scaling IT operations in a regulated environment such as biotechnology, pharmaceuticals, life sciences, or healthcare.
Ability to run cybersecurity operations and partner with the head of IT and fractional CISO on strategy, policy, and risk management.
Working knowledge of NIST CSF 2.0, ISO 27001, or similar frameworks.
Practical experience applying generative and agentic AI to security operations and insight, such as assessing control posture against NIST CSF 2.0, driving remediation, and monitoring controls.
Strong hands-on expertise in Microsoft 365, Microsoft Entra, Okta, Intune, Defender, Azure and other cloud platforms, identity and access management, endpoint management, enterprise networking and firewalls, and SIEM and XDR security monitoring and response tools.
Experience overseeing Tier 1 and Tier 2 service desk operations and outsourced providers, including MDR/MSSP relationships and ITSM tools such as Freshservice or ServiceNow, with a record of improving service levels and end-user satisfaction.
Experience with incident response, vulnerability management, vendor risk management, and audit readiness.
Excellent communication skills, including translating technical risk into business terms for executives and the Board and collaborating across functions in a fast-paced, growing organization.
Periodic travel based on business needs, including attendance at Together Weeks, Together Days, and functional meetings as requested.
Work on a hybrid schedule consistent with local office practices and the company’s in-office policy.

Nice To Haves

Advanced degree.
Familiarity with GxP, 21 CFR Part 11, SOX, and computer system validation.
Experience supporting regulatory inspections or audits, such as FDA pre-approval or BIMO inspections, in an IT or security capacity.
Understanding of AI security, privacy, and compliance risks, and experience evaluating and safely deploying AI tools such as Microsoft Copilot and security automation in a regulated environment.
Certifications such as CISSP, CISM, CISA, CCSP, ITIL, or Microsoft Azure.

Responsibilities

Partner with the VP, IT and fractional CISO to set security strategy and policy; execute the cybersecurity program, including its roadmap, risk register, and NIST CSF 2.0 standards; and report cyber risk to leadership and the Board.
Apply generative and agentic AI to security operations and risk insight, including NIST CSF 2.0 assessment, prioritized remediation, continuous control monitoring, and faster detection and response.
Oversee security operations, including threat detection and response, vulnerability and patch management, endpoint and email security, and incident response; work with MDR/MSSP partners and join investigations as needed.
Own the identity and access management program, including conditional access, phishing-resistant MFA, MFA registration controls, and privileged access.
Define secure architecture standards for cloud, network, identity, and data protection.
Partner with Legal, Quality, Data, and business leaders on responsible AI governance, including approved use cases, data protection, access controls, human oversight, and AI risk assessment aligned to the NIST AI Risk Management Framework.
Prepare Microsoft 365 for Copilot and AI, including SharePoint permissions, sensitivity labels, data loss prevention, and data classification.
Oversee cloud and network operations, including Microsoft 365, LAN/WAN, wireless, firewalls, and remote access for the Carmel and Burlington offices and remote workforce; ensure availability, performance, and cost effectiveness.
Lead Tier 1 and Tier 2 service desk operations, including endpoint and mobile device management, onboarding and offboarding, service levels, and end-user experience.
Build and scale ITIL-aligned IT processes; annually test backup, disaster recovery, and ransomware recovery, including executive incident response tabletops.
Ensure IT systems, controls, and documentation meet regulatory and audit requirements, including GxP, 21 CFR Part 11, SOX IT general controls, and privacy laws, in partnership with Quality, Legal, Finance, and the business.
Prepare IT and security for regulatory inspections and commercial launch, including audit evidence and a risk-based computer system validation and change-control approach covering Annex 11 and data integrity.
Own the multi-year infrastructure, operations, and security roadmap and budget; prioritize by business need and cyber risk; and report KPIs and risk indicators to the VP, IT and executive leadership.
Plan infrastructure and security for the transition from clinical to commercial stage, including new sites, CRO and CDMO data sharing, and expanded compliance scope.
Consolidate and govern managed service, MDR/MSSP, and service desk providers, including contracts, SLAs, budgets, and third-party risk.
Over time, hire, coach, and develop a high-performing team and build security awareness through phishing simulations and role-based training.