Senior Director, Information Security and Compliance

Foundant + smartsimple

74d

About The Position

This role involves owning and driving the maturity of Foundant's information security and GRC program end-to-end. The position requires setting a strategic roadmap to protect client trust across multiple products and regions. The Senior Director will lead and develop the Head of Technical Security and Head of GRC, aligning them around a shared vision for risk reduction and fostering a security-first culture. This role also serves as Foundant's executive voice during security incidents, communicating with clients, leadership, and regulators. Key responsibilities include building and maturing the GRC program (policies, risk registers, control frameworks, audits) to ensure compliance with US, Canadian, European, UK, and Australian regulatory requirements. The role requires close partnership with Product and Engineering leaders to embed security and privacy by design, and the development and presentation of security and compliance metrics to executive leadership and the Board. Additionally, the Senior Director will own third-party and vendor risk management and represent Foundant's security posture to clients and prospects during sales cycles and security reviews.

Requirements

8+ years of progressive leadership experience in information security and/or governance, risk, and compliance (GRC), including experience leading both technical security and compliance functions.
Demonstrated experience building or maturing a security and compliance program for a multi-product SaaS company.
Experience navigating international regulatory and compliance frameworks (e.g., GDPR, UK GDPR, Australian Privacy Act, SOC 2, ISO 27001).
Experience leading security incident response programs, including experience serving as a public-facing or client-facing spokesperson during incidents.
Experience managing and developing senior technical and compliance leaders.
Must be legally eligible to work in the United States.

Nice To Haves

CISSP, CISM, or CRISC preferred, but not required.
No specific degree requirement — equivalent professional experience is accepted.

Responsibilities

Own and drive the maturity of Foundant's information security and GRC program end to end.
Set the strategic roadmap that protects the trust our clients place in us across five products and every region we serve.
Lead and develop our Head of Technical Security and Head of GRC, aligning both teams around a shared vision for reducing risk and building a security-first culture across the organization.
Serve as Foundant's executive voice during security incidents, communicating clearly and confidently with clients, leadership, and regulators.
Build and mature Foundant's GRC program — policies, risk registers, control frameworks, and audits (e.g., SOC 2, ISO 27001) — ensuring compliance across US, Canadian, European, UK, and Australian regulatory requirements.
Partner closely with Product and Engineering leaders to embed security and privacy by design into all five product lines.
Develop and present security and compliance metrics to executive leadership and the Board, translating technical risk into business impact and clear priorities.
Own third-party and vendor risk management, ensuring our extended ecosystem meets the same standard of care we hold ourselves to.
Represent Foundant's security posture to clients and prospects during enterprise sales cycles, security reviews, and due-diligence questionnaires.
Other duties as assigned.