Senior Director, Cybersecurity and Technology Risk

TransMedics•Andover, MA

About The Position

The Senior Director, Cybersecurity and Technology Risk is a key leader on the Digital and IT leadership team, responsible for the enterprise cybersecurity program, technology risk function, and security engineering. The role establishes and continuously matures a modern, risk-based security capability that supports company growth and protects critical global operations. This includes embedding automated guardrails, continuous compliance, and secure-by-design practices across infrastructure, cloud, data, and application environments through security-as-code and policy-as-code capabilities. As a visible enterprise leader, this position builds trusted relationships across Legal, Regulatory, Physical Security, and other business functions. The leader sets direction while also coaching and developing a high-performing team and fostering a strong security culture. The role also manages partner relationships with technology and service providers and develops organizational capabilities, succession plans, and talent development strategies. TransMedics, Inc. is a commercial-stage medical technology company focused on transforming organ transplant therapy and increasing access to viable donor organs for patients worldwide. The company partners with transplant stakeholders and emphasizes technology, service, clinical care, outcomes, and employee contribution.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
15+ years of progressive experience in cybersecurity, security engineering, technology risk, or enterprise technology, including significant leadership responsibility.
Demonstrated ownership of an enterprise cybersecurity program in a complex, highly regulated, globally operating environment.
Deep hands-on experience in security architecture and engineering, including cloud security, application security, infrastructure security, DevSecOps, security-as-code, and policy-as-code.
Proven experience leading identity and access management, privileged access management, data security, data loss prevention, vulnerability management, security monitoring, and incident response capabilities.
Strong command of technology risk management, control design, assurance, regulatory examinations, and executive-level risk reporting.
Practical experience applying the NIST Cybersecurity Framework and related security and risk frameworks to enterprise programs.
Experience translating GDPR, HIPAA, CMS, and applicable FAA cybersecurity obligations into sustainable controls, operating procedures, and evidence.
Track record of partnering effectively with Legal, Regulatory, Privacy, Quality, Physical Security, Digital, and business leaders.
Excellent communication, leadership, talent development, crisis management, and organizational change skills.

Nice To Haves

Experience within highly regulated industries such as MedTech, Healthcare, Life Sciences, Aviation, or Manufacturing.
Advanced knowledge of NIST CSF, NIST 800-series guidance, ISO 27001, CIS Controls, or comparable security and risk frameworks.
Experience designing integrated cyber and physical security operating models and leading cross-functional crisis response.
Relevant professional certifications such as CISSP, CISM, CRISC, CCSP, or equivalent.

Responsibilities

Define and execute a multi-year cybersecurity strategy, operating model, and investment roadmap aligned with enterprise priorities, patient safety, and the company’s global risk profile.
Own security architecture and engineering across cloud, infrastructure, applications, data, and digital platforms, establishing secure-by-design patterns and reusable controls.
Build and maintain security-as-code and policy-as-code capabilities, including automated guardrails, continuous control validation, compliance evidence, threat detection, and remediation workflows.
Own enterprise identity and access management and privileged access management, including identity governance, authentication, authorization, access certification, and privileged account controls.
Lead data security and data loss prevention capabilities, including data classification, encryption, key management, monitoring, and controls for sensitive information.
Establish and continually improve incident response, threat management, vulnerability management, security monitoring, crisis coordination, and post-incident learning.
Build an enterprise security education and awareness program that strengthens role-based accountability, secure behaviors, and workforce readiness.
Own the technology risk management program, including risk identification, assessment, treatment, exception management, control testing, metrics, and executive reporting.
Establish and maintain a cybersecurity control framework informed by NIST and other relevant industry standards, with clear control ownership and evidence-based assurance.
Partner with the Chief Legal Officer and Chief Regulatory Officer to interpret and operationalize cybersecurity, privacy, and reporting obligations, including GDPR, HIPAA, CMS requirements, and applicable FAA regulations.
Partner with the VP of Physical Security to develop an integrated cyber and physical security operating model, coordinated incident response, and converged protection capabilities for employees, facilities, and critical operations.
Build and maintain a high-performing team responsible for executing the function’s scope.
Manage partner relationships across technology and service providers, holding partners accountable and maximizing the value of those relationships.
Develop organizational capabilities, succession plans, and targeted talent development strategies.

Benefits

Medical coverage with Health Reimbursement Account through Blue Cross/Blue Shield of MA
Dental insurance
Vision insurance
Healthcare Flexible Spending Account
Dependent Care Flexible Spending Account
Short-term disability
Long-term disability
401(k) plan
Pet insurance
Employee Stock Purchase Plan