Vice President, Information Security

Data Analysis Inc.•Plano, TX

7d•Onsite

About The Position

The Vice President of Information Security is the company’s senior information security leader and is responsible for defining, leading, and operationalizing the enterprise information security, cyber risk, governance, and data privacy program under the supervision of the CIO. This role suits a leader who is strong in policy, ISMS, governance, and privacy, but who also works hands-on with cross-functional teams to implement controls, improve resilience, and drive measurable risk reduction across a federated organization with shared services. Operating in a regulated environment, this executive will establish enterprise standards while enabling effective execution across business units, corporate functions, and shared services teams. This function will serve as the information security authority, advising the CIO and executive stakeholders on security strategy, compliance, data protection, operational risk, and program priorities. As a member of the IT leadership team, the VP will translate security requirements into business-aligned action plans and partner closely with infrastructure, applications, legal, compliance, privacy, HR, internal audit, and business leadership. The role requires influence in a federated model, where success depends on strong governance, practical implementation, and collaboration without relying solely on direct authority.

Requirements

15+ years of progressive experience in information security, cybersecurity, technology risk, privacy, or related disciplines, including significant leadership experience in complex or regulated environments.
Deep expertise in security governance, policy development, ISMS design and operation, risk management, and data privacy.
Proven success moving from policy and oversight to practical implementation through strong partnership with infrastructure, engineering, applications, legal, compliance, audit, and business teams.
Experience operating effectively in a federated or decentralized enterprise with shared services and multiple stakeholder groups.
Strong executive communication skills, with the ability to explain technical and risk issues clearly to the CIO, senior leadership, auditors, and non-technical partners.
Demonstrated experience building programs, leading through influence, and establishing credibility as the senior security authority in an organization.

Nice To Haves

Experience in one or more regulated industries such as healthcare, financial services, insurance, energy, or other compliance-intensive sectors.
Familiarity with frameworks and standards such as ISO 27001, NIST, SOC, ITGC, privacy regulations, and third-party risk practices.
Relevant certifications such as CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Implementer/Auditor.

Responsibilities

Define and lead the enterprise information security strategy, roadmap, and operating model in alignment with business goals, regulatory obligations, and risk tolerance.
Serve as the senior-most security leader for the organization, owning security governance, cyber risk, data protection, and security program maturity under the direction of the CIO.
Establish, maintain, and continuously improve the Information Security Management System (ISMS), including policies, standards, procedures, control frameworks, exceptions, and governance forums.
Build a federated security model that sets centralized expectations while enabling implementation across business units and shared services.
Lead enterprise risk assessments, control reviews, remediation oversight, and executive reporting; develop metrics and dashboards that clearly communicate risk posture, program maturity, and priority actions.
Own the enterprise data privacy and data protection program in partnership with legal and compliance, including data handling, classification, retention, privacy risk assessments, and response coordination for privacy incidents.
Partner with cross-functional teams to operationalize security requirements in technology and business processes, including identity and access management, third-party risk, secure architecture, vulnerability management, incident response, and resilience planning.
Oversee audits, regulatory examinations, customer security reviews, and internal control activities relevant to information security and privacy.
Lead, mentor, and scale internal team capabilities while effectively leveraging third-party providers, managed services, and external specialists where appropriate.
Act as a trusted advisor to the CIO and executive leadership team, presenting clear recommendations that balance protection, usability, speed, and business outcomes.