Director, Security Engineering & CloudSecOps

symplr•,

1d•$150,000 - $175,000

About The Position

The Director, Security Engineering & CloudSecOps is an experienced security leader with a strong hands-on technical foundation in information security, cloud security, enterprise security architecture, security operations, and cybersecurity risk management. Under the guidance of the organization’s CISO, this role leads the Security Engineering and CloudSecOps function, defines and executes its security engineering roadmap, and ensures scalable, resilient, and compliant security controls across cloud, hybrid, network, endpoint, application, identity, and data environments. The Director leads and mentors a high-performing team and collaborates with IT, DevOps, Engineering, Product, Compliance, Privacy, Legal, and business stakeholders to drive automation, continuous monitoring, incident readiness, vulnerability management, and secure-by-design practices across the enterprise. The role owns and evolves enterprise cloud security architecture and directs the design, deployment, administration, maintenance, monitoring, and reporting of security solutions. It partners with technical teams to embed security into architecture reviews, development pipelines, cloud deployments, infrastructure as code, remediation workflows, and continuous compliance. It also supports incident response and business continuity/disaster recovery planning, audits, risk assessments, regulatory and customer security obligations, vendor management, and executive reporting.

Requirements

University degree in Information Security, Computer Science, Computer Engineering, or Information Technology, or an equivalent combination of education and work experience.
Minimum of 10 years of experience in Information Security, IT Security, Security Engineering, Cloud Security, and/or Security Operations.
Minimum of 3–5 years of people management and leadership experience, preferably leading security engineering, cloud security, security operations, or technical security teams.
One or more of the following certifications: CISSP, CISM, CCSP, CISA, CRISC, HCISPP, SSCP, or a similar security certification.
Demonstrated technical skills in enterprise security, cloud security, network security, application security, endpoint security, identity and access management, vulnerability management, and security operations.
Strong understanding of cloud security architecture and cloud-native security controls across AWS, Azure, GCP, SaaS, or hybrid environments.
Experience securing cloud deployment pipelines, infrastructure as code, DevOps/DevSecOps workflows, and automated compliance monitoring.
Knowledge of cybersecurity frameworks and regulatory requirements, such as HIPAA, PCI DSS, NIST 800, ISO/IEC 27001/27002, SOC 1, SOC 2, and applicable privacy regulations.
Technical understanding of IP networking, data centers, disaster recovery, systems, applications, databases, and cloud-native services.
Experience with security monitoring, threat detection, incident response, vulnerability management, and security control validation.
Ability to develop and/or modify policies, procedures, standards, architecture patterns, and technical guidelines in alignment with regulatory requirements and management objectives.
Demonstrated organizational, facilitation, presentation, project management, and executive communication skills, with excellent written and verbal communication skills at all levels.
High personal integrity and ability to handle confidential matters professionally.
Ability to remain calm and manage incidents under pressure and stress.
Ability to multitask in a fast-paced, multifaceted environment.
Ability to work effectively with customers, peers, management, technical teams, and business stakeholders.
Proficiency with Microsoft Office Suite and Office 365, including Teams and SharePoint.

Nice To Haves

Bachelor’s degree or higher in Information Security, Computer Science, Computer Engineering, Information Technology, Cybersecurity, or a related field.
12+ years of experience in Information Security, IT Security, Security Engineering, Cloud Security, and/or Security Operations.
5+ years of people management and leadership experience in a technical security function.
Previous experience in healthcare IT, SaaS vendor environments, regulated industries, or organizations with significant customer security and compliance obligations.
Deep experience with cloud security architecture and operations across AWS, Azure, GCP, Kubernetes, container security, cloud networking, and application security.
Experience with Zero Trust architecture, cloud identity governance, privileged access management, secrets management, encryption, logging, detection engineering, and continuous control monitoring.
Experience with scripting, automation, or security orchestration using PowerShell, Python, Bash, Terraform, or similar technologies.
Experience managing MDR, MSSP, security tooling, cloud security, or enterprise security vendors.
Demonstrated experience with MITRE ATT&CK, threat modeling, secure architecture reviews, vulnerability prioritization, and remediation governance.
PMP, CCSP, CSSLP, AWS Security Specialty, Azure Security Engineer, Google Cloud Security Engineer, or similar certifications.

Responsibilities

Lead and mature the Security Engineering and CloudSecOps program under the guidance of the organization’s CISO.
Establish, lead, mentor, and expand the Security Engineering and CloudSecOps team, fostering high performance, continuous learning, accountability, automation, and operational excellence.
Define and execute the security engineering roadmap across enterprise, cloud, network, application, endpoint, identity and access management, vulnerability management, logging, monitoring, and detection engineering solutions.
Own and evolve enterprise cloud security architecture across cloud platforms, SaaS providers, hybrid infrastructure, applications, networking, and operational technologies, aligning it with business strategy and risk tolerance.
Design, configure, deploy, administer, maintain, monitor, and report on enterprise security solutions, including EDR, DLP, email security, access control, vulnerability scanners, SIEM, cloud security posture management, cloud workload protection, and security automation tooling.
Partner with IT, DevOps, Engineering, Product, and Infrastructure teams to embed security into architecture reviews, development pipelines, cloud deployment processes, infrastructure as code, vulnerability remediation workflows, and continuous compliance practices.
Develop and implement cloud identity and access management strategies, including least privilege, federation, privileged access, just-in-time access, identity governance, and Zero Trust principles.
Lead cloud and enterprise security hardening across systems, applications, databases, data centers, network environments, and cloud-native services.
Drive threat detection, incident response readiness, security monitoring, alert tuning, tabletop exercises, and security automation to improve response effectiveness and reduce manual effort.
Assist in designing, testing, and executing security incident response and BC/DR plans.
Review projects and provide security and compliance recommendations to IT, DevOps, Engineering, Product, and business teams throughout project lifecycles.
Participate in internal security audits, risk assessments, control testing, and gap analyses; identify weaknesses and recommend remediation actions.
Develop and report security metrics, KPIs, KRIs, and operational dashboards covering program performance, control health, vulnerability trends, incident readiness, and risk reduction progress.
Partner with Cyber Risk & Compliance, Privacy, Legal, Customer Security, and business stakeholders on regulatory requirements, customer assessments, security questionnaires, audits, and contractual security commitments.
Maintain knowledge of emerging technologies, cloud-native security capabilities, attack techniques, security threats, and applicable regulations, and provide strategic guidance to management.
Manage security engineering vendors, managed security service providers, and technology partners to ensure solutions are effective, cost-conscious, integrated, and aligned with enterprise objectives.
Write and review technical reports, architecture recommendations, executive updates, and incident or risk communications.
Resolve conflicts and issues in a timely manner, escalating to a manager as appropriate.
Work independently and collaboratively, multitasking and managing time efficiently to meet deadlines in a fast-paced environment.
Perform other duties as assigned.