Sr. Director, Information Security

Ancestry

1d•$220,000 - $250,000

About The Position

Ancestry is seeking a Sr. Director, Deputy CISO to partner with the CISO and execute the company’s enterprise-wide cyber risk strategy. The role leads the security organization, aligns security operations with business objectives, and advises senior leadership on risk. It promotes automation, metrics-driven governance, and resilience to protect sensitive customer family histories, DNA data, and personal records. As a member of the InfoSec leadership team, this executive oversees security operations, incident readiness, threat intelligence, and response to major incidents. The role partners with Engineering, Product, Legal, Privacy, and IT to incorporate risk frameworks and security-by-design into consumer applications, AI/ML pipelines, and data architectures. It leads and develops a multi-tiered organization and modernizes security capabilities using automation, AI/ML, and cloud-native architectures. The position serves as the CISO’s primary delegate, with enterprise-level accountability and exposure to executive committees, board dynamics, and ownership groups. Its operational scope includes Security Engineering, Incident Response, Cloud Security, Identity & Access Management, and Risk Management. The role translates security issues into business risk metrics that inform enterprise strategy and customer trust. Ancestry describes its work approach as location flexible: employees may work from a nearby office, from home, or in a hybrid arrangement, subject to location restrictions and role requirements. The position offers a base salary range of $220,000–$250,000, eligibility for bonus and equity, and comprehensive benefits including health, dental, and vision insurance. Actual salary depends on location and experience.

Requirements

10+ years of progressive leadership in information security.
Proven track record managing multidisciplinary security functions through subordinate managers or directors.
Extensive experience driving security strategy in cloud-native environments (AWS, GCP, or Azure) and high-scale, consumer-facing technology organizations handling sensitive or regulated data.
Demonstrated authority commanding enterprise-level critical incidents and coordinating legal, regulatory, and executive alignment under pressure.
Ability to negotiate SLAs, drive vulnerability remediation, and align risk management priorities across engineering teams without direct line authority.
Proven experience designing executive-level Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) to guide resource prioritization and capital investment.
Deep understanding of global privacy, security, and compliance frameworks relevant to sensitive consumer and biometric data.

Nice To Haves

Ability to position security as a business enabler that builds customer trust and accelerates product development.
Strategic oversight of AI-driven threat detection, securing machine-learning pipelines, and governing safe enterprise LLM adoption.
Strong discipline in business planning, quarterly strategic reviews, headcount planning, and roadmap execution.
Commitment to enterprise automation, architectural scalability, and continuous process optimization.

Responsibilities

Lead enterprise security operations, incident response readiness, and threat intelligence.
Serve as primary Incident Commander during high-stakes events, coordinating response across Legal, PR, Engineering, and executive leadership.
Partner with Engineering, Product, Legal, Privacy, and IT to embed enterprise risk frameworks and security-by-design in consumer applications, AI/ML pipelines, and data architectures.
Lead, coach, and scale a multi-tiered security organization of directors, managers, and engineers; foster accountability, succession paths, and operational excellence.
Modernize security capabilities using AI/ML, automation, and cloud-native architectures to reduce friction and operational toil and address evolving threats.
Serve as the CISO’s primary delegate and carry enterprise-level accountability.
Exercise operational authority across Security Engineering, Incident Response, Cloud Security, Identity & Access Management, and Risk Management.
Translate security matters into quantifiable business risk metrics to inform enterprise strategy and customer trust.
Negotiate SLAs, drive vulnerability remediation, and align risk management priorities across engineering teams without direct line authority.
Design executive-level KRIs and KPIs to guide resource prioritization and capital investment.
Provide strategic oversight of AI-driven threat detection, secure machine-learning pipelines, and safe enterprise LLM adoption.
Oversee business planning, quarterly strategic reviews, headcount planning, roadmap execution, automation, and continuous process optimization.