Senior Director, Cybersecurity and Technology Risk

TransMedics, Inc.•Andover, MA

About The Position

As a key leader on the Digital and IT leadership team, the Senior Director, Cybersecurity and Technology Risk owns the enterprise cybersecurity program, technology risk function, and security engineering. The role establishes a modern, risk-based security capability that supports company growth and protects critical global operations. It builds security-as-code and policy-as-code capabilities, embedding automated guardrails, continuous compliance, and secure-by-design practices across infrastructure, cloud, data, and application environments. The leader works across business functions to strengthen employee education, understanding, and awareness of cybersecurity and technology risk. As a visible enterprise leader, this person builds trusted relationships across Legal, Regulatory, Physical Security, and other business functions, setting direction while developing a high-performing team and strong security culture. The position defines and executes cybersecurity strategy, owns security architecture and engineering, identity and access management, data security, incident response, technology risk management, and cybersecurity controls. It partners with legal, regulatory, physical security, technology providers, and business leaders to operationalize obligations and coordinate protection of employees, facilities, and critical operations. TransMedics, Inc. is a commercial-stage medical technology company focused on improving access to viable donor organs and advancing transplant therapy worldwide.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
15 or more years of progressive experience in cybersecurity, security engineering, technology risk, or enterprise technology, including significant leadership responsibility.
Demonstrated ownership of an enterprise cybersecurity program in a complex, highly regulated, globally operating environment.
Deep, hands-on experience in security architecture and engineering, including cloud security, application security, infrastructure security, DevSecOps, security-as-code, and policy-as-code.
Proven experience leading identity and access management, privileged access management, data security, data loss prevention, vulnerability management, security monitoring, and incident response capabilities.
Strong command of technology risk management, control design, assurance, regulatory examinations, and executive-level risk reporting.
Practical experience applying the NIST Cybersecurity Framework and related security and risk frameworks to enterprise programs.
Experience translating GDPR, HIPAA, CMS, and applicable FAA cybersecurity obligations into sustainable controls, operating procedures, and evidence.
Track record of effective partnership with Legal, Regulatory, Privacy, Quality, Physical Security, Digital, and business leaders.
Excellent communication, leadership, talent development, crisis management, and organizational change skills.

Nice To Haves

Experience in highly regulated industries such as MedTech, Healthcare, Life Sciences, Aviation, or Manufacturing.
Advanced knowledge of NIST CSF, NIST 800-series guidance, ISO 27001, CIS Controls, or comparable security and risk frameworks.
Experience designing integrated cyber and physical security operating models and leading cross-functional crisis response.
Relevant professional certifications such as CISSP, CISM, CRISC, CCSP, or equivalent.

Responsibilities

Define and execute a multi-year cybersecurity strategy, operating model, and investment roadmap aligned with enterprise priorities, patient safety, and the company's global risk profile.
Own security architecture and engineering across cloud, infrastructure, applications, data, and digital platforms, establishing secure-by-design patterns and reusable controls.
Build and maintain security-as-code and policy-as-code capabilities, including automated guardrails, continuous control validation, compliance evidence, threat detection, and remediation workflows.
Own enterprise identity and access management and privileged access management, including identity governance, authentication, authorization, access certification, and privileged account controls.
Lead data security and data loss prevention capabilities, including data classification, encryption, key management, monitoring, and controls for sensitive information.
Establish and continually improve incident response, threat management, vulnerability management, security monitoring, crisis coordination, and post-incident learning.
Build an enterprise security education and awareness program that strengthens role-based accountability, secure behaviors, and workforce readiness.
Own the technology risk management program, including risk identification, assessment, treatment, exception management, control testing, metrics, and executive reporting.
Establish and maintain a cybersecurity control framework informed by NIST and other relevant industry standards, with clear control ownership and evidence-based assurance.
Partner with the Chief Legal Officer and Chief Regulatory Officer to interpret and operationalize cybersecurity, privacy, and reporting obligations, including GDPR, HIPAA, CMS requirements, and applicable FAA regulations.
Partner with the VP of Physical Security to develop an integrated cyber and physical security operating model, coordinated incident response, and converged protection capabilities for employees, facilities, and critical operations.
Build and maintain a high-performing team responsible for executing the function's scope.
Manage and maintain partner relationships across technology and service providers, holding partners accountable and maximizing value from those relationships.
Develop organizational capabilities, succession plans, and targeted talent development strategies to maintain a high-performing team.

Benefits

Medical coverage with Health Reimbursement Account through Blue Cross/Blue Shield of MA
Dental
Vision
Healthcare Flexible Spending Account
Dependent Care Flexible Spending Account
Short Term Disability
Long Term Disability
401K Plan
Pet insurance
Employee Stock Purchase Plan