Director of Information Security

Fun Town RV•Fort Worth, TX

5d•Onsite

About The Position

The Director of Information Security leads Fun Town RV’s information security program, setting security strategy, policies, and standards; managing risk and compliance; and leading security incident response. The role partners with the Information Systems team, which implements and maintains the company’s technology, and reports security status to executive leadership at least annually and to the CIO regularly. This position oversees the company’s security program, including risk assessments, vulnerability management, penetration testing, incident response, regulatory and industry compliance, privacy support, PCI DSS requirements, vendor risk, access management, data protection, Microsoft cloud security, business continuity and disaster recovery, employee awareness training, cyber insurance, audits, IT service management processes, and security monitoring. The role also works across departments and with vendors, auditors, legal counsel, and executives to establish and implement security requirements. This is a full-time, on-site position at Fun Town RV’s corporate office in Fort Worth, Texas, with occasional travel to dealership locations and availability outside normal business hours to respond to security incidents.

Requirements

Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Systems, or a related field, or equivalent work experience.
At least 8 years of experience in information technology or information security, including at least 5 years in an infrastructure and security role combination.
Experience building or managing an information security program, including policies, risk assessments, and incident response.
Hands-on experience securing Microsoft 365 and Microsoft Entra ID environments.
Working knowledge of security regulations and frameworks such as PCI DSS, NIST Cybersecurity Framework, or CIS Controls.
Experience with Microsoft Intune, Microsoft Defender, and Microsoft Purview.
Experience managing vendor risk and working with cyber insurance carriers or auditors.
Familiarity with ITIL-based IT service management.
Strong understanding of identity and access management, network security, endpoint security, encryption, and logging.
Ability to translate security requirements into clear standards that IT teams can implement.
Ability to assess risk and explain it in business terms to executives and non-technical staff.
Strong written communication skills, including writing policies, reports, and incident documentation.
Sound judgment and composure when leading responses to security incidents.
Ability to work across departments and with outside vendors, auditors, and legal counsel.
Authorization to work in the United States.

Nice To Haves

Experience in automotive or RV retail, financial services, or another business that handles consumer financing data.
CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager) certification; optional, not required.
Microsoft Certified: Cybersecurity Architect Expert (SC-100) or Security Operations Analyst (SC-200) certification; optional, not required.
CompTIA Security+ certification; optional, not required.
ITIL 4 Foundation certification; optional, not required.

Responsibilities

Build, maintain, and continuously improve the company’s information security program, and report on its status to executive leadership at least annually.
Develop, maintain, and enforce information security policies, standards, and procedures, including acceptable use, access control, data protection, logging and monitoring, and vendor risk management.
Conduct periodic risk assessments and oversee remediation of identified risks.
Manage the vulnerability management program, including regular vulnerability assessments, annual penetration testing, and remediation tracking.
Maintain the incident response plan, lead responses to security incidents, and coordinate required notifications to regulators, customers, and partners.
Work with legal and compliance to identify applicable regulatory and industry requirements and implement the IT and information security programs, policies, procedures, and controls needed to meet them.
Support legal, compliance, and other departments on related programs, including customer privacy and identity theft prevention.
Work with the payment processor and Accounting to confirm card payment processing meets PCI DSS requirements and maintain requirements applicable to the company.
Assess and monitor the security of third-party vendors that handle company or customer data.
Set access management standards, including least-privilege access, multi-factor authentication, and periodic access reviews.
Define data protection standards, including encryption, data classification, data loss prevention, retention, and secure disposal.
Define security requirements and configuration standards for the Microsoft cloud environment and verify that they are met.
Lead business continuity and disaster recovery planning and testing.
Develop and deliver security awareness training for employees, including internal phishing simulation testing.
Manage cyber insurance requirements and prepare the company for audits and assessments.
Partner with IT leadership to design and improve IT service management processes and review changes for security impact.
Define logging and monitoring requirements, monitor security alerts and metrics, and provide regular status reports to the CIO.