Security and Compliance Director
Posted 15 Oct 2026
Advertised as “Director, Security and Compliance”
BranchFactor Summary
The original posting with the fluff stripped out
- Expected experience
- 10+ yrs
- Management level
- People management
No salary listed for this role.
Field of studyBusiness, Computer Science, Cybersecurity, Information Systems
Study levelBachelor's or higher
CertificationsCISSP, CISM, CISA, CRISC, CIPP
Director, Security and Compliance
Job Overview
The Director of Security and Compliance is a strategic, highly technical leader responsible for designing, scaling, and overseeing our global information security and regulatory compliance programs. Reporting to the CIO, this role bridges the gap between technical security engineering, legal requirements, and business operations. Key responsibilities include defining our security posture, leading Governance, Risk, and Compliance (GRC) initiatives, and ensuring continuous alignment with industry frameworks.
The ideal candidate for this role is someone who doesn't just manage checklists but actively translates complex regulatory policies into practical, testable technical controls that allow our engineering and business teams to move fast without losing control.
Core Responsibilities
1. Governance, Risk & Compliance (GRC) Strategy
- Framework Management: Lead the strategy, implementation, and continuous monitoring of core security frameworks relevant to our business (e.g., SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA).
- Data Privacy Adherence: Partner closely with Legal counsel to ensure corporate compliance with global data privacy regulations (e.g., GDPR, CCPA/CPRA).
- Risk Management: Design and execute regular enterprise risk assessment programs. Identify vulnerabilities, prioritize risks based on business impact, and collaborate with department heads on remediation plans.
- Policy Architecture: Draft, update, and enforce company-wide information security policies and procedures, ensuring they adapt to evolving engineering workflows (like CI/CD pipelines and infrastructure-as-code).
2. Security Operations & Oversight
- Security Posture Optimization: Your Security Engineering team will partner with the IT Infrastructure team to monitor infrastructure security, access controls (IAM), and data encryption protocols.
- Incident Response: Serve as a key leader on the Incident Response Team, helping to orchestrate investigations, mitigation efforts, and required regulatory disclosures in the event of a breach.
- Third-Party Risk Management (TPRM): Oversee the security vetting process for vendors, software tools, and supply chain partners to minimize external risk exposure.