Senior Director, Secure MA&D

Cencora•Conshohocken, IN

About The Position

The Senior Director, Secure MA&D owns the enterprise strategy, governance, and delivery of cybersecurity across the full transaction lifecycle - pre-close due diligence, Day 1 readiness, post-close integration, and divestiture separation. This role is the single accountable security leader to Corporate Development, Finance, and Legal for cyber risk that affects valuation, deal structure, closing conditions, and integration cost. The Senior Director leads a global team of principals and analysts and a bench of third-party diligence partners; sets the risk thresholds and decision rights that determine when a cyber finding is deal-impacting; advises executive leadership and the Board on aggregate transaction risk; and drives the organizational change required to bring acquired entities onto enterprise security standards.

Requirements

Bachelor's degree required; advanced degree in business or a technical discipline preferred.
15+ years of progressive experience in cybersecurity, technology risk, or security consulting, including 5+ years leading teams and enterprise-scale programs.
Demonstrated experience leading cybersecurity due diligence and integration across multiple completed transactions, including at least one carve-out, divestiture, or separation.
Working fluency in deal mechanics and terminology, including letters of intent, data-room and clean-team protocols, SPA and TSA constructs, purchase price adjustments, escrow and indemnity, and representations and warranties insurance.
Financial acumen sufficient to build, defend, and negotiate multi-year remediation and run-rate cost estimates with Finance and Corporate Development.
Breadth and depth across core security domains, including identity and access management, cloud and network security, endpoint, data protection, application security, security operations and incident response, vulnerability management, GRC, and third-party risk.
Experience in a highly regulated industry; healthcare, pharmaceutical distribution, life sciences, or medical technology strongly preferred, with working knowledge of HIPAA, GxP, DSCSA, SOX, PCI DSS, and GDPR.
Familiarity with NIST CSF, NIST SP 800-53 and 800-171, ISO 27001, CIS Controls, and HITRUST as diligence and integration baselines.
Proven vendor management and budget ownership, including managing external assessment partners against fixed timelines and quality expectations.
Demonstrated ability to influence and align executive stakeholders without direct authority, across global business units and geographies.
Exceptional written and verbal communication skills, including Board and deal-committee materials, with a track record of being decisive on incomplete information.
Proven discretion in handling material non-public information and simultaneous confidential transactions, with a clear understanding of insider-trading and information-barrier obligations.

Nice To Haves

Relevant certifications such as CISSP, CISM, CRISC, CISA, CCSP, or PMP preferred.
Willingness to travel and to support compressed transaction timelines, including nonstandard hours and multiple time zones.

Responsibilities

Own and evolve the enterprise Secure MA&D strategy, operating model, and capability roadmap covering acquisitions, divestitures, carve-outs, joint ventures, and minority investments.
Establish the governance framework, decision rights, risk thresholds, and escalation criteria that determine when a cyber finding is deal-impacting versus a post-close remediation item.
Set the standard for diligence playbooks, cost models, integration blueprints, Day 1 control baselines, and executive reporting used across the transaction portfolio.
Own the function's annual plan, budget, tooling, and third-party bench, sized to support an unpredictable and confidential deal pipeline.
Define and report the metrics that demonstrate program effectiveness, including diligence cycle time, cost-estimate accuracy, Day 1 control coverage, and time to remediate inherited risk.
Position Secure MA&D as an enabler of inorganic growth by balancing speed of deal execution against defensible risk coverage.
Lead, coach, and develop a global team of Secure MA&D principals and analysts; set performance standards, career paths, and succession plans.
Allocate scarce specialist capacity across concurrent transactions and adjust staffing as deals accelerate, pause, or collapse.
Direct third-party diligence and integration partners end to end, including selection, scoping, commercial terms, quality assurance, and performance management.
Build a team culture of disciplined judgment, documentation, and absolute confidentiality consistent with material non-public information obligations.
Serve as player-coach on the largest, most sensitive, or most contested transactions.
Direct pre-close cybersecurity due diligence under compressed timelines, restricted target access, staged data-room release, and clean-team constraints, drawing defensible conclusions from incomplete evidence.
Calibrate diligence depth and approach to deal type, size, and thesis, recognizing the differences between a negotiated acquisition, a competitive auction, an asset versus stock purchase, and a carve-out from a larger parent.
Quantify and defend remediation, integration, tooling, licensing, labor, and run-rate cost estimates within the deal model, including capital versus operating treatment and dis-synergy impacts.
Ensure cyber findings are reflected in deal documents and protections, including representations and warranties, purchase price adjustments, escrow and indemnity, disclosure schedules, and closing conditions.
Define security requirements and exit criteria for Transition Service Agreements and reverse TSAs; direct separation planning for divestitures, including data segregation, entitlement removal, and protection of retained intellectual property.
Direct Day 1 readiness, including minimum viable controls, identity and network interconnection decisions, endpoint and email protections, logging and monitoring onboarding, and incident response coverage for the acquired entity.
Own the handoff from diligence to delivery, transferring risks, named owners, and funded remediation plans to security capability owners with accountability tracked through TSA exit and integration close.
Lead the security response when a target is found to have an active or historical compromise, coordinating pre-close containment, valuation impact, and disclosure implications with Legal and Corporate Development.
Establish the risk-acceptance and exception framework for inherited risks that cannot be remediated by Day 1, ensuring documented ownership, funding, and time-bound closure.
Ensure diligence and integration address the regulatory exposure relevant to the enterprise, including HIPAA and protected health information, GxP and validated systems, DSCSA, PCI DSS, SOX IT general controls, GDPR, and cross-border data transfer requirements.
Aggregate inherited cyber risk across the transaction portfolio into the enterprise risk register and report exposure trends to executive risk committees.
Oversee the third-party and fourth-party risk introduced through acquired vendor ecosystems, contracts, and data-sharing arrangements.
Align Secure MA&D practices to recognized frameworks such as NIST CSF, NIST SP 800-53, ISO 27001, CIS Controls, and HITRUST, and support internal audit and regulatory inquiry into transaction risk.
Serve as the security voice in deal committee, investment committee, and Board-level materials, presenting a clear position, a risk-adjusted cost range, and an explicit confidence level.
Translate technical findings into valuation, timing, compliance, and operational impact for non-technical executives across Finance, Legal, Corporate Development, and Technology.
Produce concise, decision-grade deliverables for audiences that will not read a technical report, while retaining the underlying evidence for audit and integration use.
Brief and align security capability owners, business unit leaders, and acquired-company executives on findings, obligations, and sequencing.
Represent the enterprise credibly while protecting confidentiality and negotiating position.
Deliver difficult messages to deal sponsors and target leadership without stalling the transaction, and escalate with evidence when risk exceeds tolerance.
Lead the organizational change required to bring acquired entities onto enterprise security standards, including policy adoption, control uplift sequencing, and tooling migration.
Build stakeholder engagement, training, and communication plans that reduce resistance, shadow IT, and control drift during integration.
Assess acquired security talent and define retention, onboarding, and organizational design recommendations in partnership with Human Resources and security leadership.
Manage the cultural transition from a smaller or less mature security environment to enterprise expectations, sequencing change to preserve business continuity and acquired-team morale.
Institutionalize lessons learned after each close, feeding improvements back into playbooks, cost models, and Day 1 baselines.