Director, Cyber Risk Services (Information Security)

What you'll do

• Develop and lead the cybersecurity risk management strategy aligned with enterprise goals and regulatory requirements.
• Establish and maintain standardized risk management frameworks, methodologies, and taxonomies across the organization.
• Oversee enterprise-wide risk assessments to identify threats, vulnerabilities, and control gaps.
• Manage a centralized risk register to track, prioritize, and assign ownership for remediation tasks.
• Lead the third-party risk management program including vendor assessments and contract reviews.
• Monitor vulnerability remediation processes and ensure compliance with established service level agreements.
• Define and report key performance indicators (KPIs) and key risk indicators (KRIs) to executive leadership.
• Manage and enhance GRC tools and platforms to improve risk monitoring and reporting capabilities.

What we're looking for

• Ideally targeting individuals with 8+ years of experience in cybersecurity, risk management, or information security.
• Expertise in cybersecurity risk management frameworks, methodologies, and enterprise risk integration is required.
• Experience leading risk assessment programs, risk remediation efforts, and third-party risk management is required.
• Strong understanding of cybersecurity frameworks (e.g., NIST CSF, ISO 27001) and regulatory requirements is required.
• Experience developing executive-level reporting and communicating risk insights to senior leadership is required.
• Strong leadership, communication, and stakeholder management skills are required.
• Experience as a people leader overseeing cybersecurity risk or GRC functions (preferred).
• Experience in highly regulated industries, professional certifications (CISSP, CISM, CRISC, or CISA), or experience in healthcare/finance (preferred).