VP, Cybersecurity

Vertafore•Denver, CO

13d•$220,000 - $250,000

About The Position

The VP, Cybersecurity develops and executes Vertafore’s enterprise cybersecurity strategy and leads cybersecurity operations, architecture, engineering, and risk mitigation. The role is accountable for protecting the company’s SaaS products, cloud infrastructure, corporate systems, and sensitive customer data through security controls, threat detection, incident response, and continuous improvement. It provides strategic leadership across security operations, product and application security, cloud security, identity and access management, vulnerability management, and emerging technology security, including artificial intelligence. The VP partners with Engineering, Product, Information Technology, Legal, and Compliance to integrate security into business operations and product development and to support customer commitments and regulatory obligations. The role establishes measurable objectives, develops global security teams, manages cybersecurity investments, and gives executive leadership visibility into material risks, operational performance, and program maturity. The position includes travel up to 10% and may be performed remotely with a stable internet connection, with office attendance when required.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
15 or more years of progressive cybersecurity experience.
10 or more years of cybersecurity leadership experience.
Expertise in enterprise cybersecurity strategy, security operations, incident response, zero-trust architecture, cloud security, and product/application security.
Strong knowledge of SaaS environments, secure software development, identity and access management, vulnerability management, and security engineering.
Understanding of AI security threats and controls, third-party security risk, NIST frameworks, ISO 27001, MITRE ATT&CK, and security assurance requirements such as SOC 2.
Demonstrated ability to lead globally distributed teams, influence senior stakeholders, manage budgets, and translate technical risk into business decisions.
Excellent communication, executive reporting, prioritization, collaboration, and crisis leadership skills.
Ability to work remotely with a stable internet connection as needed and to work from an office location when required.
Legally authorized to work in the United States.
Ability to travel up to 10% of the time.
Occasional lifting and/or moving of up to 10 pounds; frequent repetitive hand and arm movements to operate a computer; close vision for computer work; frequent sitting and/or standing.

Nice To Haves

Advanced degree.
CISSP, GIAC, CISM, or equivalent cybersecurity certification.

Responsibilities

Develop and execute a multi-year, risk-based cybersecurity strategy and roadmap aligned with business priorities and evolving threats.
Lead and develop cybersecurity teams, establish accountability, support succession planning and professional development, and foster a strong security culture.
Own cybersecurity budgets, resource planning, vendor investments, program priorities, and performance metrics; report material risks and progress to executive leadership.
Advance zero-trust principles, including identity and access management, least privilege, network segmentation, and continuous verification.
Partner with Roper Technologies corporate cybersecurity to align the program with its cyber controls framework, participate in portfolio-wide initiatives, and report on control maturity, material risks, and incidents.
Lead security monitoring, threat detection, investigation, containment, and remediation, including a coordinated 24/7 monitoring and response operating model.
Oversee security operations tooling, detection engineering, endpoint protection, threat intelligence, threat hunting, and external attack surface management.
Maintain and exercise incident response plans; coordinate responses with IT, Engineering, Legal, Compliance, and external specialists, including post-incident reviews and corrective actions.
Partner with IT and business continuity owners on cyber recovery readiness, ransomware resilience, disaster recovery exercises, and responses to major technology disruptions.
Define and monitor operational measures such as detection coverage, response effectiveness, remediation timeliness, and control performance.
Direct security architecture and engineering for cloud environments, SaaS platforms, corporate infrastructure, and data center systems where applicable.
Partner with Product and Engineering to integrate security into the software development lifecycle, including secure design, code and dependency security, penetration testing, and application vulnerability remediation.
Establish security requirements and review processes for AI-enabled products, agents, models, and integrations, including access controls, prompt-injection defenses, sensitive-data protection, and monitoring of AI-specific threats.
Assess material security risks from development environments, cloud configurations, privileged access, and third-party technology integrations.
Oversee technical risk assessments, threat modeling, vulnerability identification, prioritization, and remediation across enterprise and product environments.
Establish and validate security controls and technical standards consistent with applicable frameworks and business requirements.
Partner with Compliance on vendor security assessments by defining technical security requirements, evaluating material vendor risks, and tracking technical remediation.
Partner with Legal and Compliance on security governance, contractual commitments, audits, and regulatory obligations while retaining ownership of technical security controls and corrective actions.
Provide executive-level technical support for significant customer security inquiries, escalations, and security-related commitments.
Partner with Compliance and Assurance on customer assessments and audit evidence, ensuring technical accuracy and timely issue resolution while supporting, rather than duplicating, operational questionnaire and audit coordination.
Build productive relationships with business and technology leaders and communicate cybersecurity priorities, tradeoffs, and risk decisions clearly.
Lead cybersecurity projects and transformation initiatives to deliver defined outcomes within approved scope, timelines, and budgets.