Information Security Officer

Sompo International • Boston, MA

5d • $180,000 - $225,000

About The Position

Sompo is seeking an Information Security Officer to manage and continuously modernize its Information Security program for global operations while maintaining alignment with external and corporate requirements. The role oversees a large environment comprising more than 7,000 users, hundreds of developers and IT staff, more than 10,000 network devices, and over 75 physical and cloud locations. The position may be based at any of Sompo’s listed U.S. offices: Purchase, NY; New York City; Morristown, NJ; Conshohocken, PA; or Charlotte, NC.

The Information Security Officer is responsible for maintaining technical security controls, vulnerability management, security alerting, incident response, and security participation in the systems development lifecycle. The role also establishes communications to keep Sompo users informed about emerging threats, policy changes, security achievements, and recommendations. The position requires substantial technical, security, risk-management, and senior leadership experience, along with the ability to guide a hybrid team and communicate with audiences ranging from technical colleagues to regulators and non-technical leaders.

Requirements

• At least 15 years of experience in a combination of technical, security, and risk-management roles.
• At least 7 years in a senior management role within an information security function.
• Technical familiarity with security patterns, operations, and controls for traditional Windows, cloud, and SaaS environments.
• Systematic thinking, including understanding security controls within the larger operating environment, anticipating issues, and engaging colleagues to minimize disruption.
• Experience integrating regulatory requirements, corporate policies, and industry standards into operating procedures and designs.
• Experience maintaining and communicating security strategy and technical architecture.
• Ability to translate operational metrics into meaningful KPIs and risk quantifiers.
• Excellent written, verbal, and interpersonal communication skills for engaging non-technical leaders, customers, regulators, and technical colleagues.
• Experience maintaining a fast-changing security program with continuous improvement driven by threat intelligence and adversary tactics, operational metrics, and company priorities.
• Leadership experience managing a hybrid team of direct reports, matrix reports, managed services, and specialist contractors.
• Bachelor’s degree in computer science, information security, or a related field.
• Recognized information security certification such as CISSP or CISM.

Nice To Haves

• Prior experience adopting FAIR threat modeling within the SDLC.
• Familiarity with DevSecOps processes, tooling, and controls.
• Experience gaining and maintaining certifications such as ISO 270xx or SOC 2.
• Knowledge of regional security and data privacy regulations related to minimization, encryption, and cross-border data access.

Responsibilities

• Maintain effective technical security controls across systems and processes, with documented designs and real-time instrumentation.
• Manage security controls for malicious activity prevention and detection, encryption, data loss prevention and detection, activity and audit logging—especially for privileged identities and access—and adversarial simulation.
• Detect, report, and escalate vulnerabilities to the operational teams responsible for affected systems or processes.
• Maintain organization-wide vulnerability data for periodic and threat-driven real-time reporting.
• Operate and continuously evolve an efficient, instrumented security alerting function that addresses Sompo’s threat environment.
• Maintain an efficient and tested incident response procedure capable of handling events of any scale.
• Participate in the systems development lifecycle to ensure alignment with the information security program.
• Establish a communications program informing Sompo users about emerging threats, upcoming policy changes, recent achievements, and general security recommendations.
• Manage a hybrid team of direct reports, matrix reports, managed services, and specialist contractors, including ongoing professional development for direct reports.
• Maintain and communicate security strategy and technical architecture.
• Translate operational metrics into meaningful KPIs and risk quantifiers.
• Continuously improve the security program in response to threat intelligence and adversary tactics, operational metrics, and company priorities.
• Integrate regulatory requirements, corporate policies, and industry standards into operating procedures and designs.
• Structure projects and programs according to risk priorities.

Benefits

• Two medical plans, including a Traditional PPO and a Consumer Driven Health Plan with a Health Savings Account and employer contribution.
• Pharmacy benefits with mail-order options.
• Dental benefits, including orthodontia coverage for adults and children.
• Vision benefits.
• Health Care and Dependent Care Flexible Spending Accounts.
• Company-paid life and AD&D benefits, with optional supplemental life coverage for employees, spouses, and children.
• Company-paid disability benefits with salary continuation payments.
• 401(k) Retirement Savings Plan with employer contributions.
• Paid time off and company-paid holidays.
• Parental leave benefits and adoption assistance program.
• Employee Assistance Program.
• Tax-Free Commuter Benefit.
• Tuition reimbursement and professional qualification benefits.
• Compensation program with base salary and performance incentives.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior