Director, Security Engineering & CloudSecOps

The Director, Security Engineering & CloudSecOps is an experienced security leader with a strong hands-on technical foundation in information security, cloud security, enterprise security architecture, security operations, and cybersecurity risk management. Under the guidance of the organization’s CISO, this role is accountable for leading the Security Engineering and CloudSecOps function, defining and executing the security engineering roadmap, and ensuring scalable, resilient, and compliant security controls across cloud, hybrid, network, endpoint, application, identity, and data environments. This person will lead and mentor a high-performing team, collaborate with IT, DevOps, Engineering, Product, Compliance, Privacy, Legal, and business stakeholders, and drive automation, continuous monitoring, incident readiness, vulnerability management, and secure-by-design practices across the enterprise.

• Under the guidance of organization’s CISO, lead and mature a world-class Security Engineering and CloudSecOps program that protects the company, its customers, and its brand. 
• Establish, lead, mentor, and expand the Security Engineering and CloudSecOps team, fostering a culture of high performance, continuous learning, accountability, automation, and operational excellence. 
• Define and execute the security engineering roadmap across enterprise security solutions, cloud security, network security, application security, endpoint security, identity and access management, vulnerability management, logging, monitoring, and detection engineering. 
• Own and evolve the enterprise cloud security architecture across cloud platforms, SaaS providers, hybrid infrastructure, applications, networking, and operational technologies, ensuring alignment with business strategy and risk tolerance. 
• Design, configure, deploy, administer, maintain, monitor, and report on enterprise security solutions, including but not limited to EDR, DLP, email security, access control, vulnerability scanners, SIEM, cloud security posture management, cloud workload protection, and security automation tooling. 
• Partner with IT, DevOps, Engineering, Product, and Infrastructure teams to embed security into architecture reviews, development pipelines, cloud deployment processes, infrastructure as code, vulnerability remediation workflows, and continuous compliance practices. 
• Develop and implement cloud identity and access management strategies, including least privilege, federation, privileged access, just-in-time access, identity governance, and Zero Trust principles. 
• Lead cloud and enterprise security hardening initiatives across systems, applications, databases, data centers, network environments, and cloud-native services. 
• Drive threat detection, incident response readiness, security monitoring, alert tuning, tabletop exercises, and security automation to improve response effectiveness and reduce manual operational effort. 
• Assist in designing, testing, and executing the company’s security incident response and BC/DR plans. 
• Review and provide security and compliance recommendations to appropriate IT, DevOps, Engineering, Product, and business projects to ensure security concerns are addressed throughout the project lifecycle. 
• Participate in internal security audits, risk assessments, control testing, and gap analyses to identify weaknesses, assess effectiveness of existing controls, and recommend remediation actions. 
• Develop and report security metrics, KPIs, KRIs, and operational dashboards to communicate program performance, control health, vulnerability trends, incident readiness, and risk reduction progress to leadership and stakeholders. 
• Partner with Cyber Risk & Compliance, Privacy, Legal, Customer Security, and business stakeholders to support regulatory requirements, customer assessments, security questionnaires, audits, and contractual security commitments. 
• Research and maintain effective knowledge of emerging technologies, cloud-native security capabilities, attack techniques, security threats, and applicable regulations; provide guidance to management for strategic planning. 
• Manage security engineering vendors, managed security service providers, and technology partners to ensure solutions are effective, cost-conscious, integrated, and aligned with enterprise objectives. 
• Write and review technical reports, architecture recommendations, executive updates, and incident or risk communications as needed. 
• Solve conflicts and issues in a timely manner, escalating to manager as appropriate. 
• Work individually and in a team environment. Multitask and use time efficiently to meet project/task deadlines in a fast-paced environment. 
• Other duties as assigned. 

• University degree in Information Security, Computer Science, Computer Engineering, Information Technology (or equivalent of education and work experience) 
• Minimum of 10 years of experience in Information Security, IT Security, Security Engineering, Cloud Security, and/or Security Operations 
• Minimum of 3-5 years of people management and leadership experience, preferably leading security engineering, cloud security, security operations, or technical security teams 
• One or more of the following certifications: CISSP, CISM, CCSP, CISA, CRISC, HCISPP, SSCP, or similar security certification 
• Demonstrated technical skills in enterprise security, cloud security, network security, application security, endpoint security, identity and access management, vulnerability management, and security operations 
• Strong understanding of cloud security architecture and cloud-native security controls across AWS, Azure, GCP, SaaS, or hybrid environments 
• Experience securing cloud deployment pipelines, infrastructure as code, DevOps/DevSecOps workflows, and automated compliance monitoring 
• Knowledge of cybersecurity frameworks and relevant regulatory requirements, such as HIPAA, PCI DSS, NIST 800, ISO/IEC 27001/27002, SOC 1, SOC 2, and applicable privacy regulations 
• Technical understanding of IP networking, data centers, disaster recovery, systems, applications, databases, and cloud-native services 
• Experience with security monitoring, threat detection, incident response, vulnerability management, and security control validation 
• Ability to develop and/or modify policies, procedures, standards, architecture patterns, and technical guidelines in alignment with regulatory requirements and management objectives 
• Demonstrated organizational, facilitation, presentation, project management, and executive communication skills with excellent written and verbal communication skills at all levels 
• High level of personal integrity and ability to professionally handle confidential matters 
• Capable of acting calmly and managing incidents under high pressure and stress 
• Capable of multitasking in a fast paced, multifaceted environment 
• Ability to work well with customers, peers, management, technical teams, and business stakeholders 
• Proficient with Microsoft Office Suite and Office365, including Teams and SharePoint 

Preferred Education Experience, Skills and Abilities 

• Bachelor’s degree or higher in Information Security, Computer Science, Computer Engineering, Information Technology, Cybersecurity, or related field 
• 12+ years of experience in Information Security, IT Security, Security Engineering, Cloud Security, and/or Security Operations 
• 5+ years of people management and leadership experience in a technical security function 
• Previous experience in healthcare IT, SaaS vendor environments, regulated industries, or organizations with significant customer security and compliance obligations 
• Deep experience with cloud security architecture and operations across AWS, Azure, GCP, Kubernetes, container security, cloud networking, and application security 
• Experience with Zero Trust architecture, cloud identity governance, privileged access management, secrets management, encryption, logging, detection engineering, and continuous control monitoring 
• Experience with scripting, automation, or security orchestration using tools or languages such as PowerShell, Python, Bash, Terraform, or similar technologies 
• Experience managing MDR, MSSP, security tooling, cloud security, or enterprise security vendors 
• Demonstrated experience with MITRE ATT&CK, threat modeling, secure architecture reviews, vulnerability prioritization, and remediation governance 
• PMP, CCSP, CSSLP, AWS Security Specialty, Azure Security Engineer, Google Cloud Security Engineer, or similar certifications are a plus