Director - Security

Cyncly•United States,

4d•$150,000 - $175,000•Remote

About The Position

The Director – Security is a senior IT leadership role responsible for defining, executing, and continuously maturing Cyncly's global cyber security strategy, data protection Programme, and information security posture. Reporting to the Head of IT & Cyber Security, this role serves as the primary owner of all security disciplines across the organization — from threat detection and incident response to security architecture, data governance, and regulatory compliance. A critical element of this role is owning Cyncly's compliance obligations end-to-end, including achieving and maintaining SOC 2 Type II certification across Cyncly's global operations, as well as ensuring adherence to GDPR, ISO 27001, and other applicable regulatory and industry frameworks. The Director will act as Cyncly's senior authority on all matters relating to information security risk, data privacy, and cyber resilience, partnering closely with Product, Engineering, Legal, and business leadership to embed security into the fabric of everything Cyncly does.

Requirements

Bachelor's degree or equivalent in Computer Science, Information Security, Cybersecurity, or a related field; advanced degree preferred.
20+ years of progressive experience in information security, cyber security, and data protection, with a minimum of 10+ years in a senior security leadership or director-level role.
Proven, hands-on experience achieving and maintaining SOC 2 Type II certification in a complex, multi-product, global software or SaaS organisation.
Deep expertise in GDPR, CCPA, and global data privacy regulations, with direct experience managing regulatory engagements and data subject rights obligations.
Demonstrated experience building and maturing security functions from the ground up or transforming existing security organisations within PE-backed or high-growth environments.
Track record of leading complex, organisation-wide security programmes including cloud security transformations, zero-trust implementations, and M&A security integrations.
Experience operating across globally distributed organisations across multiple time zones and jurisdictions.
Cloud Security: Deep expertise in securing Microsoft Azure environments (including Azure Security Centre, Defender for Cloud, Sentinel); experience with AWS or GCP security is advantageous.
Compliance Frameworks: Expert-level knowledge of SOC 2 (Trust Services Criteria), ISO 27001/27002, NIST CSF, CIS Controls, and GDPR/CCPA; experience with PCI DSS or HIPAA is a plus.
Security Operations: Strong understanding of SIEM (e.g. Microsoft Sentinel, Splunk), SOAR, EDR/XDR platforms, and vulnerability management tools (e.g. Qualys, Tenable, Rapid7).
Data Protection: Expertise in DLP technologies, data classification, encryption (at rest and in transit), and data governance tooling.
Identity Security: Deep knowledge of Active Directory, Azure AD/Entra ID, PAM solutions (e.g. CyberArk, BeyondTrust), SSO, MFA, and Conditional Access.
Application & DevSecOps Security: Experience embedding security into DevOps pipelines (SAST, DAST, SCA), IaC security scanning, and container/Kubernetes security.
Network Security: Knowledge of enterprise network security, zero-trust networking, SD-WAN security, firewall management (Palo Alto, Cisco), and microsegmentation.
CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager).
Ability to represent the security function credibly at Board and C-suite level; experienced in translating complex threats into business risk language.
Ability to set a long-term security vision while managing immediate operational and compliance demands in a fast-growing, acquisition-driven organisation.
Methodical, process-oriented, and detail-driven when managing compliance programmes; experience managing multiple concurrent audit engagements without disruption to BAU.
Calm, decisive, and structured under pressure; proven ability to lead cyber incident response across distributed teams and communicate clearly to executive stakeholders.
Strong cross-functional collaborator who can engage credibly with Engineering, Product, Legal, Finance, and Business leadership to drive security outcomes without being a blocker.
Uses data, threat intelligence, and risk frameworks to prioritise decisions, quantify security investments, and demonstrate security value to the business.
Comfortable operating autonomously at pace in a PE-backed, M&A-active, global environment where priorities evolve rapidly.
Applicants must be legally authorized to work in the country in which they are applying to work (United States or Canada). This role is not eligible for employer sponsorship now or in the future.

Nice To Haves

Advanced degree preferred.
Experience with AWS or GCP security is advantageous.
Experience with PCI DSS or HIPAA is a plus.
CCSP (Certified Cloud Security Professional), CRISC (Certified in Risk and Information Systems Control), or equivalent.
ISO 27001 Lead Implementer or Lead Auditor; SOC 2 examination experience or relevant audit credentials.
CEH, OSCP, or other technical security certifications demonstrating depth in offensive or operational security.

Responsibilities

Define and own Cyncly's global cyber security strategy, roadmap, and operating model, aligning security investment and priorities to business risk and growth objectives.
Build and lead a high-performing, globally distributed cyber security and information security team, setting clear direction, developing talent, and fostering a culture of security awareness and accountability.
Act as the primary security advisor to the Head of IT & Cyber Security, CTO, and senior leadership, translating complex threats and technical risks into clear, business-relevant guidance.
Represent Cyncly's security posture to customers, prospects, auditors, regulators, and the Board as required, including participation in enterprise risk and audit committee reporting.
Establish and govern security policies, standards, and procedures organisation-wide, ensuring they are understood, implemented, and maintained across all business units and geographies.
Drive a continuous improvement culture within the security function, leveraging threat intelligence, industry benchmarking, and emerging best practices to evolve Cyncly's defences.
Own end-to-end accountability for Cyncly's SOC 2 Type II certification programme — including scoping, control design, evidence collection, auditor management, and remediation of findings — ensuring successful annual certification and ongoing continuous compliance.
Lead and maintain compliance with ISO 27001, GDPR, CCPA, and other applicable data protection and privacy regulations across all jurisdictions in which Cyncly operates.
Serve as the primary point of contact for external security auditors, regulatory bodies, and certification authorities, managing all audit engagements from planning through to report issuance.
Develop and maintain a compliance calendar and evidence management framework, ensuring Cyncly is audit-ready at all times with minimal operational disruption.
Monitor the evolving global regulatory landscape and proactively identify and address new compliance obligations arising from changes in law, customer contractual requirements, or market expectations.
Collaborate with Legal, Finance, and HR to ensure organisation-wide policies (data retention, privacy notices, HR security controls, supplier assurance) meet compliance obligations.
Define and implement Cyncly's data classification framework, data governance policies, and information lifecycle management practices, ensuring sensitive data is identified, protected, and handled appropriately throughout its lifecycle.
Oversee the design and implementation of data loss prevention (DLP) controls, encryption standards, and data access management programmes across all data repositories, cloud platforms, and SaaS applications.
Embed data privacy by design principles into all product development, infrastructure, and business processes, in partnership with Engineering and Product leadership.
Manage the end-to-end response to data subject access requests (DSARs), data breach notifications, and privacy incidents, ensuring timely and compliant responses in accordance with GDPR and local privacy laws.
Partner with Enterprise Architecture and Engineering to ensure data flows, storage locations, and processing activities are documented, controlled, and compliant with applicable regulations and customer contractual obligations.
Own and mature Cyncly's Security Operations Centre (SOC) capability — whether in-house or managed — ensuring 24/7 detection, triage, and response coverage across endpoints, cloud, network, and application layers.
Develop, maintain, and test Cyncly's Incident Response (IR) plan and cyber crisis management playbooks, including tabletop exercises, breach simulations, and executive-level crisis communication procedures.
Act as the senior Incident Commander for significant cyber security incidents, providing decisive leadership through containment, eradication, recovery, and post-incident review.
Drive the adoption of threat intelligence platforms, SIEM/SOAR tooling, EDR/XDR solutions, and vulnerability management programmes to improve Cyncly's detection and response capabilities.
Reduce mean time to detect (MTTD) and mean time to respond (MTTR) through automation, playbook-driven response, and continuous tuning of detection logic.
Lead the organisation's vulnerability management and penetration testing programmes, ensuring findings are tracked, prioritised by risk, and remediated within agreed SLAs.
Define and govern Cyncly's security architecture principles and standards across cloud (Azure/AWS), on-premises, hybrid, and SaaS environments, ensuring security is embedded by design in all technology programmes.
Lead the design and implementation of zero-trust network architecture, identity-centric security controls, and micro-segmentation strategies across Cyncly's global environment.
Oversee the evaluation and selection of security tooling and platforms, ensuring Cyncly's security stack is fit-for-purpose, integrated, and cost-effective.
Partner with the Infrastructure, Cloud, and DevOps teams to embed security into the CI/CD pipeline, IaC templates, and cloud landing zones (DevSecOps).
Provide security architecture review and sign-off for major technology programmes, M&A integrations, new product launches, and significant platform changes.
Own and mature Cyncly's Identity and Access Management (IAM) programme, including role-based access control (RBAC), least-privilege enforcement, and access certification processes across all systems and applications.
Lead the design and implementation of Privileged Access Management (PAM) controls, ensuring all privileged accounts and administrative access are governed, monitored, and auditable.
Drive the adoption of Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Conditional Access policies across all Cyncly platforms and third-party applications.
Collaborate with HR and IT Operations to ensure joiners, movers, and leavers processes include timely and accurate provisioning and deprovisioning of access rights.
Lead cyber security due diligence assessments for M&A targets, evaluating their security posture, data protection practices, compliance status, and technical debt, providing risk-rated findings to inform deal decisions.
Define and execute security integration roadmaps for acquired businesses, onboarding them into Cyncly's security standards, tooling, and compliance frameworks within agreed timelines.
Build and maintain repeatable M&A security assessment and integration playbooks to accelerate and de-risk future acquisitions.
Ensure acquired entities meet SOC 2 and other applicable compliance obligations as part of the post-acquisition integration programme.
Design and deliver a comprehensive security awareness and training programme for all Cyncly employees globally, including phishing simulations, role-specific training, and executive security briefings.
Manage Cyncly's third-party and supplier security risk programme, ensuring all critical vendors and partners are assessed for security risk and held to Cyncly's minimum security standards via contractual and audit mechanisms.
Build and maintain a security champion network across Engineering and Product teams, fostering a security-first culture at the development and operational level.