Vice President, Cybersecurity, Risk & Compliance (Deputy CISO)

IDC Research Inc.•Boston, MA

11d•$165,800 - $290,220•Remote

About The Position

IDC's CIO organization is shifting from project-by-project security review to a pre-cleared, guardrail-based model so that new technology — including AI pilots — can ship in days instead of months. This role owns that shift: building the security architecture, controls, and governance that let the business move fast without moving recklessly. The VP, Cybersecurity, Risk & Compliance serves as Deputy CISO, leading enterprise security strategy, architecture, and operations for IDC day to day and standing in for the CISO on internal leadership, vendor, and operational matters. The role carries direct accountability for keeping pace with an accelerating delivery model across infrastructure, applications, and AI/automation initiatives. This is a hands-on leadership role: the VP sets the security roadmap, runs the team, and personally removes the friction that slows delivery — replacing per-project security gatekeeping with pre-approved patterns, standing guardrails, and fast, decisive risk calls.

Requirements

12+ years in cybersecurity, including 5+ years in a senior leadership role, owning strategy, architecture, risk, and a team.
Experience operating as a deputy or right hand to a CISO or equivalent security executive, including acting with delegated authority in their absence.
Demonstrated experience securing SaaS, cloud, and AI/LLM platforms at enterprise scale.
Direct ownership of an enterprise technology risk management program, including risk registers, risk quantification, and executive/board-level risk reporting.
Working knowledge of major compliance frameworks (SOC 2, ISO 27001, GDPR); experience with China-specific frameworks (MLPS/ICP) a strong plus
Hands-on experience with modern threat defense tooling, zero-trust architecture, and identity management
Experience owning a security engineering practice, including secure architecture guidance for a core platform and a penetration testing program through remediation.
A track record of balancing security rigor with delivery speed in agile, DevOps, or CI/CD
Bachelor’s degree in computer science, Information Security, or related field; CISSP, CISM, or equivalent certification preferred

Nice To Haves

Direct experience securing generative AI or LLM-based products, including runtime defense and agentic system monitoring.
Experience in a multinational, research, or information-services business
Experience designing a governance model that pre-clears risk categories rather than reviewing every project individually.
Exposure to global regulatory environments, including operating in or adjacent to the Chinese market.
Experience with GRC platforms and leading external audit engagements through to clean opinions

Responsibilities

Own the enterprise cybersecurity strategy and multi-year architecture roadmap, aligned to business and AI/automation priorities.
Design and maintain a library of pre-approved security patterns and guardrails so new projects and pilots can launch without a bespoke review cycle.
Sit on and support the AI Governance Council as the security authority, pre-clearing model, data, and vendor patterns rather than gating individual pilotsAI and platform security.
Lead security for IDC's AI platforms and pilots — prompt-injection defense, runtime AI protection, agentic SOC coverage, PII detection, and red-team/canary testing.
Partner with the AI & Automation team to build security into the 5-day intake-to-ship pilot lifecycle from day one, not as a late-stage checkpoint.
Own identity and access management, zero-trust architecture, and SSO/SAML standards across the enterprise application portfolio
Own the security engineering function, including Quanta Cyber Guidance — the secure-by-design reference architecture and build standards for IDC's Quanta platform — keeping it current as Quanta expands into new markets.
Own the enterprise penetration testing program (internal, external, and third-party engagements) across Quanta and the broader application portfolio, tracking every finding through to verified remediation.
Build and maintain secure coding standards and embedded security tooling (SAST/DAST, dependency and vulnerability scanning) so engineering teams get fast, actionable findings inside their own pipelines
Own the enterprise technology risk register, driving risk identification, quantification, and mitigation tracking across infrastructure, applications, and AI initiatives.
Set risk appetite and tolerance thresholds with the CIO and executive leadership, and make the fast, decisive accept/mitigate/escalate calls that keep pre-cleared pilots moving.
Author and maintain enterprise security and risk policies, standards, and control frameworks, ensuring consistent enforcement across a global organizationCompliance and audit.
Drive certification and regulatory compliance programs (SOC 2 Type II, ISO 27001, GDPR, and market-specific frameworks such as MLPS/ICP for China operations) on defined timelines.
Own the enterprise audit calendar, serving as the primary liaison to internal and external auditors and ensuring evidence and control documentation are always audit-ready.
Manage vendor security and compliance risk assessments against committed SLAs so third-party review never becomes the delivery bottleneck Security operations.
Own incident response, threat detection, and security logging/monitoring (SIEM, cloud-native logging) across the global estate
Serve as Deputy CISO, acting with full authority on the CISO's behalf across day-to-day security, risk, and compliance decisions, and standing in for the CISO in their absence.
Build, lead, and develop a global cybersecurity, risk, and compliance team, including succession planning for key roles.
Partner with the CISO to prepare risk posture, compliance status, and audit program health for the CIO, executive leadership, and Audit Committee, and represent the program directly when the CISO is unavailable.
Partner with Infrastructure, Applications, and Data leadership to embed security and compliance checkpoints directly into CI/CD and rapid deployment pipelines.