Director of Information Security

ArentFox Schiff • Washington, DC

36d • $231,000 - $371,000 • Onsite

About The Position

The Director of Information Security leads the development, operation, and continuous improvement of ArentFox Schiff’s information security, cybersecurity, privacy, compliance, and technology risk programs. The role protects firm and client information by setting security strategy, governance, architecture, controls, and operational capabilities across cloud services, identity, applications, endpoints, networks, email, data, AI, and third-party services.

Working with administrative departments, attorneys, clients, and external providers, the Director enables responsible technology adoption while maintaining acceptable risk levels. The role oversees security policies and standards, ISO certification, regulatory compliance, AI and emerging-technology risk, vendor security, security operations, incident response, identity and access management, data protection, security awareness, client audits, business continuity, and security program performance. This exempt position can be based in the firm’s New York, Washington, DC, Los Angeles, or Chicago office.

Requirements

• Bachelor’s degree in a related field, specialized training, or equivalent professional experience.
• Relevant industry certification, such as CISSP, CISM, CISA, or a comparable credential.
• Eight or more years of progressively responsible experience in cybersecurity, information security, technology risk, privacy, compliance, security architecture, or a related discipline, including at least three years in a leadership role.
• Demonstrated success leading a multidisciplinary security program in a legal, professional services, financial services, healthcare, or similarly sensitive and regulated environment.
• Experience developing and operating enterprise security capabilities across Microsoft 365, Azure, Entra ID, cloud applications, email, endpoints, networks, data, APIs, and third-party services.
• Experience evaluating the security, privacy, compliance, and operational impact of AI and AI-enabled applications.
• Experience governing OAuth applications, Microsoft Graph permissions, enterprise application registrations, privileged and workload identities, certificates, service accounts, secrets, and role-based access controls.
• Experience leading incident response, vendor assessments, remediation efforts, client and ISO audits, security awareness initiatives, and executive risk reporting.
• Experience applying ISO/IEC 27001, ISO/IEC 27002, the NIST Cybersecurity Framework, the NIST AI Risk Management Framework, CIS Controls, and Zero Trust principles.
• Experience managing security teams and providers, budgets, contracts, implementation projects, and service levels.

Nice To Haves

• Law firm or professional services experience is strongly preferred.
• Experience using platforms such as ReliaQuest, Proofpoint, Abnormal Security, Netskope, Microsoft Defender, Microsoft Purview, Microsoft Sentinel, and Microsoft Intune.

Responsibilities

• Develop and execute the firm’s information security strategy, governance framework, policies, standards, and annual security roadmap.
• Lead enterprise cybersecurity, privacy, risk management, and compliance programs in alignment with applicable laws, regulations, client requirements, and industry frameworks.
• Establish security requirements and governance for cloud services, AI, generative AI, machine learning, autonomous agents, and other emerging technologies.
• Direct enterprise risk assessments, security architecture reviews, and control evaluations; prioritize and remediate cybersecurity, technology, vendor, and operational risks.
• Oversee security operations, including threat monitoring and detection, vulnerability management, incident response, forensic investigations, and security engineering.
• Provide governance and oversight for identity and access management, data protection, network security, endpoint security, application security, cloud security, and third-party technology integrations.
• Support development and oversight of business continuity, disaster recovery, and physical security programs.
• Advise firm leadership, business stakeholders, clients, auditors, and vendors on cybersecurity, privacy, regulatory, and technology risk matters.
• Lead client security audits, security questionnaires, Outside Counsel Guidelines reviews, Requests for Proposal, and other client-driven security assessments.
• Direct vendor security reviews and due diligence for managed security services, cloud providers, software platforms, and AI-enabled solutions.
• Partner with Technology Services, Innovation, administrative departments, and business leaders to integrate security into enterprise projects, system development, operational processes, and technology-enabled initiatives.
• Promote security awareness through training, communication, policy enforcement, and ongoing education for attorneys, staff, and technology personnel.
• Define and report cybersecurity metrics, program maturity, emerging risks, and strategic initiatives to executive leadership.
• Manage security budgets, contracts, projects, and strategic investments.

Benefits

• Medical, dental, and vision benefits.
• Profit-sharing.
• Generous paid time off.
• Flexible benefit options.
• A flexible reimbursement account for personal well-being expenses.
• Certain positions are eligible for a performance-based bonus, payable monthly or annually.

What This Job Offers

• Job Type: Full-time
• Career Level: Director