Senior Director, Cybersecurity & Enterprise Infrastructure

Rimkus•Chapel Hill, NC

22h

About The Position

The Senior Director, Cybersecurity & Enterprise Infrastructure is the accountable leader for the security, resilience, and technical foundation of Rimkus's technology estate. Reporting to the Chief Transformation Officer, this leader owns enterprise cybersecurity, cloud and hybrid infrastructure, endpoint and identity platforms, the enterprise data platform, the technology integration of acquired businesses, and the compliance and audit program that evidences all of it. This is a leader-of-leaders role. It directs a multidisciplinary organization of infrastructure engineers, data engineers, systems and security staff, and the IT systems director function — setting architecture and standards, building bench strength, and converting security findings into completed, evidenced remediation. Rimkus operates in a client environment where confidentiality, privileged information, and defensible data handling are core to the business. As a private-equity-backed, acquisitive professional services firm, the company is subject to sponsor-directed security assessments, client due diligence, and formal audit expectations — while simultaneously acquiring and integrating businesses on a recurring basis. Cybersecurity is therefore not a subordinate function of this role — it is its center of gravity, and every acquisition either strengthens or dilutes it. Because the position reports into the Transformation organization, it carries an explicit mandate to standardize, consolidate, and modernize rather than merely operate.

Requirements

12+ years of progressive information technology experience, including at least 8 years concentrated in cybersecurity and/or enterprise infrastructure.
6+ years leading technical teams at a manager or director level, including demonstrated experience leading other leaders and managing managers.
Demonstrated accountability for an enterprise cybersecurity program in a multi-site organization of comparable or greater scale (1,500+ users), including international operations.
Deep, current, hands-on operating experience with Microsoft Entra ID and the Microsoft 365 E5 security stack in a cloud-first or hybrid environment.
Documented record of leading a real security incident through containment, eradication, recovery, and post-incident reporting to executives.
Proven experience remediating findings from an external security assessment, regulatory audit, or private-equity sponsor-directed review, with measurable posture improvement over a defined period.
Required: demonstrated experience leading the technology and cybersecurity workstream of at least two completed acquisitions, including hands-on accountability for both pre-close diligence and post-close integration execution.
Required: experience consolidating acquired Microsoft 365 / Entra ID tenants and domains, migrating identities, mailboxes, and endpoint management, and rationalizing duplicate platforms, licensing, and vendor contracts.
Demonstrated ability to translate technical diligence findings into quantified integration cost, synergy, and risk estimates for corporate development and executive audiences.
Experience remediating inherited security debt in acquired environments — bringing a lower-maturity estate up to enterprise control standards on a committed timeline.
Required: CISSP or CISM, or a demonstrably equivalent senior security credential.
Participation in on-call escalation and after-hours or weekend incident response is required. Security incidents do not observe business hours.
Eligible to work in the United States.

Nice To Haves

Master's degree or MBA preferred.
Additionally valued: CISA, CRISC, GIAC (GCIH, GCIA, GCFA, GSEC), ITIL 4, PMP.

Responsibilities

Own enterprise cybersecurity strategy, target-state architecture, and a funded multi-year roadmap aligned to business risk and growth.
Serve as the accountable security leader: maintain the security policy set, the enterprise risk register with quantified business impact, and documented risk-acceptance decisions.
Establish and chair a security governance forum; report posture, risk trend, and remediation progress to executive leadership, the Board, and the private-equity sponsor on a defined cadence.
Lead and coordinate independent security assessments, penetration tests, and sponsor-directed reviews; own the remediation plan, evidence package, and measurable score improvement window over window.
Own client-facing security due diligence, security questionnaires, contractual security terms, and cyber insurance underwriting responses.
Build and operate a security awareness, phishing simulation, and role-based training program with measured behavioral outcomes.
Set the security investment strategy: extract full value from entitlements already licensed before adding tooling; justify new spend with quantified risk reduction.
Own Microsoft Entra ID architecture, hybrid identity, and the M365 tenant identity security model end to end.
Design, govern, and change-control Conditional Access. Replace accumulated app-by-app policy sprawl with a documented, tenant-wide baseline (all users × all cloud applications) plus a governed exception register with owners and expiry dates.
Drive universal multifactor authentication to full coverage and lead adoption of phishing-resistant methods (FIDO2/passkeys, Windows Hello for Business, certificate-based authentication); retire weak factors.
Eliminate legacy authentication protocols enterprise-wide and migrate remaining dependencies — scanners, SMTP relays, line-of-business integrations — to OAuth 2.0 and modern authentication.
Implement and operate Privileged Identity Management: just-in-time elevation, approval workflow, time-bound roles, session justification, and recurring access reviews. Eliminate standing administrative privilege.
Govern trusted network locations and remote-access trust assumptions. Ensure privileged and administrative access paths — management APIs, PowerShell, device-code flow, service-to-service — are explicitly controlled rather than implicitly trusted by network position.
Own service principal, enterprise application, and OAuth consent governance: least-privilege API permissions, admin-consent workflow, ownership attestation, and credential/secret rotation.
Establish identity lifecycle automation (joiner / mover / leaver), entitlement and access reviews, guest and external-collaboration governance, and the elimination of shared and generic accounts.
Harden credential standards: minimum length, breach-password correlation, rotation policy, elimination of blanket expiry exemptions, and group-managed service accounts for service identities.
Own SIEM and security analytics (Microsoft Sentinel): data-source onboarding and completeness, retention and archive tiering sufficient for forensic reconstruction, detection engineering, tuning, and ingestion cost management.
Validate detection coverage against MITRE ATT&CK and close gaps across initial access, credential access, persistence, privilege escalation, lateral movement, and exfiltration.
Own the Microsoft Defender XDR stack — Defender for Identity, Endpoint, Cloud Apps/CASB, and Office 365 — with defined triage SLAs by severity and a managed, non-aging alert queue.
Establish continuous (24×7) monitoring coverage, in-house or through a managed detection and response partner, with defined escalation paths, on-call rotation, and enforced performance SLAs.
Author, socialize, and test the incident response plan and playbooks — credential exposure, business email compromise, ransomware, insider data theft, service-account and privileged-identity compromise, third-party breach — with named roles and decision authority.
Run tabletop and purple-team exercises at least annually; drive after-action findings to closure.
Lead investigation and containment during live incidents: forensic triage, evidence preservation and chain of custody, and coordination with Legal, HR, Communications, outside counsel, insurers, and law enforcement as required.
Own identity threat detection and response — including credential-exposure response, risky-identity remediation to documented closure within SLA, service-account credential attack detection, and token-theft defense.
Own vulnerability and patch management, external attack surface monitoring, secure configuration baselines, and remediation SLAs by severity.
Own the insider risk and data loss prevention program: data classification, sensitivity labeling, and monitoring and enforcement against removable-media exfiltration, mass download, and sharing to personal accounts — with specific controls for PHI, PCI, PII, and litigation-sensitive material.
Direct Azure and hybrid cloud strategy: landing zone and subscription governance, network topology, identity and RBAC model, Key Vault and secrets management, Azure Policy, Defender for Cloud, and Well-Architected reviews.
Own infrastructure-as-code and configuration management; move change execution from manual console work to automated, peer-reviewed, auditable pipelines.
Oversee network, firewall, SD-WAN, DNS and email security, and remote access across all offices; modernize implicitly trusted VPN architecture toward zero-trust network access and segmentation.
Own data center, virtualization, storage, and the remaining on-premises footprint, including cloud migration and legacy platform exit plans.
Own backup, immutable and air-gapped recovery, disaster recovery, and business continuity; define, test, and evidence RTO and RPO for every critical system with documented exercises at least annually.
Own the Microsoft 365 estate — Exchange Online, SharePoint/OneDrive, Teams — and Copilot/AI readiness including the data-governance prerequisites.
Own ITSM discipline: change, incident, and problem management, capacity planning, availability and service-delivery SLAs, and published operational metrics.
Own endpoint management (Intune, Autopilot, and co-managed configuration manager estate); consolidate legacy management paths and retire duplicate tooling.
Raise device compliance above target and extend compliant-device Conditional Access from selected applications to all users and all workloads.
Enforce full-disk encryption, EDR coverage, application control, and patch compliance to defined, reported thresholds across Windows, macOS, iOS, and Android.
Own the end-user computing experience, service desk performance, and the quality of onboarding and offboarding execution.
Lead the data engineering function: pipeline and integration architecture, orchestration, warehouse/lakehouse platform, and business intelligence delivery.
Establish data governance — ownership, classification, lineage, retention, and quality standards — in partnership with Legal, Compliance, and business lines.
Secure the data platform: least-privilege and row/column-level access, managed identities and secrets management, encryption in transit and at rest, and monitoring of analytics service accounts and service principals.
Partner with business leadership to deliver reporting and analytics products that improve client delivery, utilization, and operational decision-making.
Govern AI and machine learning adoption, including acceptable-use standards, data-protection controls, and review of AI-connected data surfaces.
Own the technology compliance program mapped to NIST Cybersecurity Framework and NIST 800-53, CIS Controls v8, ISO 27001, and applicable HIPAA, PCI DSS, and privacy obligations.
Maintain the control library, control owners, testing calendar, and evidence repository; operate continuous control monitoring so the organization is audit-ready at any time rather than at audit time.
Lead internal and external audits and assessments, SOC 2 readiness where applicable, and client and legal security due diligence.
Ensure audit and activity log retention, completeness, and immutability are sufficient for forensic reconstruction, legal hold, and eDiscovery obligations; own the Purview compliance capability.
Own third-party and vendor risk assessment, security terms in contracts, and ongoing supplier monitoring.
Ensure records retention, data residency, and cross-border data handling meet client, contractual, and regulatory requirements across the international footprint.
Extend the compliance and control program to acquired entities on a defined timeline, and represent the combined environment in client, sponsor, and audit inquiries.
Lead technology and cybersecurity due diligence on acquisition targets — identity and tenant architecture, security posture and control maturity, prior incidents and breach history, infrastructure and technical debt, application and data estate, licensing and contract assignability, key-person and vendor dependencies, and cyber insurance history.
Translate diligence findings into quantified integration cost, one-time and run-rate synergy estimates, remediation timelines, and identified deal risks — presented in a form Corporate Development, the Transformation organization, and the sponsor can act on. Escalate findings material to valuation or deal structure.
Own Day 1 technology readiness — email and collaboration access, network connectivity, endpoint and EDR coverage, credential issuance, and a minimum security baseline for acquired users before broad access is granted. No acquired environment gains trusted access to Rimkus systems before defined controls are verified.
Direct post-close integration: Entra tenant and domain consolidation, identity and mailbox migration, device enrollment and endpoint management onboarding, network integration and segmentation, application rationalization, and data migration with classification and retention applied.
Bring acquired environments to Rimkus security standards on a committed timeline — MFA and Conditional Access enforcement, privileged access remediation, legacy authentication elimination, EDR and patch coverage, backup and recovery, and log onboarding into the SIEM. Remediate inherited risk rather than inheriting it silently.
Design interim-state architecture that allows business operations to continue while limiting blast radius between an unremediated acquired environment and the Rimkus estate.
Eliminate redundant platforms, tooling, licensing, and vendor contracts acquired through deals; deliver documented cost takeout and a simplified estate.
Build and maintain a reusable M&A technology integration playbook — diligence question set, Day 1 checklist, integration workplan template, control-uplift standard, and closeout criteria — with lessons learned applied deal over deal.
Support separation activity where required, including data segregation, access revocation, and transition service arrangements.
Partner with HR, Legal, and business leadership on acquired-employee onboarding experience, communications, and adoption of Rimkus platforms and security expectations.
Lead, coach, and develop a multidisciplinary team including the IT systems director function, infrastructure engineers, data engineers, systems administrators, and security personnel.
Rebuild bench strength following attrition of long-tenured staff: define role charters, a skills matrix, career paths, and a prioritized hiring plan; attract and retain scarce cloud and security talent.
Eliminate key-person dependency as an explicit, measured objective. Mandate and audit documented runbooks, standard operating procedures, architecture and network diagrams, configuration baselines, and credential/escalation records; require cross-training on every critical system.
Establish on-call rotation, escalation matrices, shift handoff standards, and blameless after-action review discipline.
Operate as a hands-on-capable leader. This role is expected to work directly in Entra, Azure, Intune, Sentinel, Defender, and PowerShell/Graph to validate configurations, troubleshoot, and unblock the team during incidents, transitions, and coverage gaps — not to delegate exclusively.
Set clear performance expectations, deliver candid reviews, and build documented succession coverage for every critical function.
Foster a culture of accountability, security ownership, operational rigor, and internal customer service.
Build and manage operating and capital budgets for infrastructure, security, endpoint, and data platforms; deliver measurable efficiency without reducing control coverage.
Own licensing strategy and optimization across M365/E5, Azure, and security tooling; rationalize overlapping products.
Select, negotiate, and manage MSP, MSSP/MDR, VAR, carrier, and consulting relationships; enforce SLAs and run quarterly business reviews.
Lead program and project governance for security and infrastructure initiatives with defined milestones, named owners, dependency management, and executive-level status reporting.