Senior Director, Identity, Cybersecurity Governance & Risk

Breakthru Beverage Group•Linthicum, MD

9d•$180,000 - $200,000•Remote

About The Position

The Senior Director Identity, Cybersecurity Governance & Risk is a senior cybersecurity leader responsible for enterprise Identity and Access Management (IAM), cybersecurity governance, cyber risk management, third-party risk management, compliance, and security performance measurement. This role owns strategy, implementation, operations, and continuous improvement of IAM capabilities while establishing the governance, policies, controls, risk processes, and metrics required to manage cybersecurity risk effectively across the enterprise. The position partners closely with the IT Vendor Management Function, Enterprise Architecture, Audit, Legal, Compliance, Human Resources, Operations, IT functions, and business leadership. The successful candidate will combine strategic leadership, security program management, technical credibility, operational discipline, and the ability to communicate cybersecurity risk in clear business terms.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or related discipline, or equivalent professional experience.
10+ years of progressive experience in cybersecurity, information security, technology risk, and related disciplines.
Significant leadership experience directing enterprise cybersecurity programs in a complex organization.
Demonstrated experience developing and executing enterprise cybersecurity strategies, platform implementations, and transformation programs.
Strong knowledge of identity governance, authentication, privileged access, access lifecycle management, and modern identity architectures.
Demonstrated expertise in cybersecurity governance, risk management, third-party risk, compliance, and control frameworks.
Experience with standards such as NIST CSF, NIST 800-53, ISO 27001/27002, CIS Controls, CMMC, SOC 2, or comparable frameworks.
Experience supporting audits, compliance assessments, and executive risk reporting.
Demonstrated ability to develop meaningful cybersecurity KPIs, KRIs, dashboards, and performance reporting.
Strong executive communication and stakeholder-management skills.
Experience managing cybersecurity budgets, vendors, consulting partners, and large-scale cross-functional initiatives.
Two or more professional certifications such as CISSP, CISM, CISA, or CGEIT.
Strong analytical and problem-solving skills, with the ability to diagnose and resolve complex issues across highly distributed environments.
Excellent prioritization, organizational, and decision-making skills
Strategic thinking, conceptual problem-solving, and adaptability

Responsibilities

Define and execute a multi-year IAM strategy, roadmap, architecture, operating model, and governance framework that aligns with business priorities, improved operational efficiencies, and technology transformation initiatives.
Oversee implementation and ongoing operations of IAM capabilities including IGA, IVIP, SSO, MFA, PAM, access provisioning, recertification, and identity lifecycle management.
Establish enterprise standards for authentication, authorization, least privilege, role-based access, privileged access, and joiner/mover/leaver processes.
Drive automation and modernization of access administration to improve security, user experience, and operational efficiency.
Oversee IAM imitative performance, service levels, application onboarding, policy exceptions, and remediation of excessive, dormant, orphaned, or inappropriate access.
Manage IAM technology vendors, implementation partners, and managed service providers.
Establish and maintain the enterprise cybersecurity governance and risk management framework.
Develop and maintain cybersecurity policies, standards, control requirements, exception processes, and accountability models.
Partner with Enterprise Risk Management and executive leadership to align cybersecurity risk with enterprise risk appetite and tolerance.
Maintain the cybersecurity risk register and ensure risks have clear owners, supported remediation plans, and appropriate executive visibility.
Lead cybersecurity risk assessments across applications, infrastructure, cloud services, business processes, and major technology initiatives.
Translate technical risk into business impact, including financial, operational, regulatory, reputational, and business partner considerations.
Establish processes for risk treatment, residual risk assessment, formal risk acceptance, and escalation.
Establish a cybersecurity measurement framework focused on risk reduction, control effectiveness, operational performance, and program maturity.
Define KPIs, KRIs, service metrics, thresholds, and escalation criteria.
Develop executive dashboards and Board reporting on cybersecurity risks, trends, program performance, and priorities.
Use trend analysis and leading indicators to identify deteriorating performance or emerging risks.
Benchmark cybersecurity maturity and performance against industry standards and peer organizations.
Lead the cybersecurity component of the organization's third-party risk management program.
Establish risk-based due diligence and assessment requirements based on vendor criticality, platform tiering, data classifications, connectivity, and business impact.
Oversee cybersecurity reviews during vendor selection, contracting, onboarding, periodic reassessment, renewal, and termination.
Partner with IT Vendor Management and Legal to establish appropriate cybersecurity contractual requirements.
Ensure significant vendor risks have documented remediation plans, compensating controls, or formally approved risk acceptance.
Provide enhanced oversight of critical and high-risk vendors and report significant third-party risks to leadership.
Establish and maintain a cybersecurity control framework supporting the organizational culture and strategic direction, that aligns with applicable standards and regulatory requirements, including frameworks such as NIST CSF, NIST 800-53, ISO 27001/27002, ISO 31000, ISO 27090, CMMC, CIS Controls, SOC 2, and PCI DSS where applicable.
Translate cybersecurity standards and regulatory requirements into practical enterprise policies, controls, and evidence requirements.
Oversee cybersecurity control assessments, maturity evaluations, audit support, and remediation activities.
Partner with Audit, Compliance, Legal, and external assessors during audits, and security reviews.
Monitor evolving cybersecurity standards and requirements and assess their impact on the organization.
Develop multi-year strategies and annual operating plans across IAM, governance, risk, compliance, and third-party risk management functions.
Translate cybersecurity strategy into prioritized programs, investments, roadmaps, and measurable outcomes.
Build business cases for cybersecurity investments and communicate expected risk-reduction and business benefits.
Serve as a trusted cybersecurity advisor to the CISO, CIO, executive leadership, and business stakeholders.
Represent cybersecurity in major enterprise technology and business transformation initiatives.
Other duties, as assigned by the jobholder’s supervisor, may also be required