Director of Security, Risk, & Compliance

Cross Companies•Tulsa, OK

About The Position

Cross is seeking a Director- or VP-level leader, based on experience and qualifications, to oversee its Security, Risk, and Compliance function. The role offers a potential career path to Chief Information Security Officer (CISO). The Director develops, implements, and maintains the organization’s cybersecurity risk management, regulatory compliance, and privacy programs. The role integrates compliance, privacy, and cybersecurity under a unified governance strategy for an Internet Service Provider (ISP), Managed Service Provider (MSP), cloud services provider, and data center operator. It partners with IT, Network Operations, Sales, HR, and Finance to build a culture of compliance and risk awareness. This position directly supervises a team, with responsibilities that include hiring, performance management, disciplinary actions, onboarding and training, mentoring, task assignment, goal setting, and performance evaluation. It also requires providing excellent customer service in accordance with company standards, including ownership, professionalism, troubleshooting, keeping customers informed, and delivering an experience beyond their expectations.

Requirements

Bachelor’s degree in Information Security, Cybersecurity, Risk Management, Business, Information Systems, or a related field.
7+ years of experience in governance, risk management, compliance, cybersecurity, auditing, or related disciplines.
3+ years in a management role.
Strong knowledge of cybersecurity and risk management frameworks.
Experience leading audits and regulatory compliance programs.
Excellent communication and executive presentation skills.
Valid driver’s license.
Strong analytical, problem-solving, and decision-making skills.
Ability to interpret complex regulatory, cybersecurity, and compliance requirements.
Ability to manage multiple projects, priorities, and deadlines.
Strong attention to detail and organizational skills.
Ability to maintain confidentiality and exercise sound judgment.
Effective communication, leadership, and stakeholder management skills.
Ability to perform effectively under pressure during audits, incidents, and regulatory reviews.

Nice To Haves

Experience working for a broadband, telecommunications, MSP, or cloud services provider.
Familiarity with FCC regulatory requirements.
Experience supporting SOC 2, HIPAA, NIST CSF, or CMMC programs.
Understanding of network operations and cybersecurity controls.
Experience managing enterprise risk programs.
Certified Information Systems Security Professional (CISSP).
Certified Information Security Manager (CISM).
Certified in Risk and Information Systems Control (CRISC).
Certified Compliance & Ethics Professional (CCEP).

Responsibilities

Oversee compliance with cybersecurity frameworks, including NIST Cybersecurity Framework (CSF), CIS Controls, SOC 2, and CMMC.
Coordinate security audits, penetration testing, vulnerability assessments, and compliance reviews.
Facilitate tabletop exercises and resilience testing.
Support incident management and post-incident reviews.
Monitor security-related regulatory changes and industry requirements.
Ensure compliance with applicable telecommunications regulations and reporting obligations.
Support requirements related to FCC regulations and USF and broadband funding programs, and serve as the company’s CPNI officer.
Support customer compliance requirements in regulated industries, including healthcare (HIPAA) and financial services.
Assist sales and operations teams with security questionnaires, RFPs, and customer audits.
Manage data privacy programs and related policies.
Oversee data classification, retention, and governance standards to ensure proper handling of confidential, customer, and employee information.
Coordinate external regulatory and information security audits and assessments.
Track audit findings and corrective actions.
Facilitate risk assessments and internal audits of regulatory compliance, information security, and privacy practices.
Identify, assess, monitor, and report cybersecurity, regulatory, and privacy risks.
Lead third-party and vendor risk management programs.
Develop and maintain corporate compliance policies and standards.
Lead compliance training and security awareness initiatives.
Provide customer service in accordance with company standards, including ownership, professionalism, troubleshooting, and keeping customers informed.
Hire, train, mentor, and manage team members, including performance management and disciplinary actions.
Assign tasks, set team goals, and evaluate team performance.
Travel to company facilities, customer locations, and industry events as needed; respond outside normal business hours during security incidents, audits, or business continuity events when required.