Director of Security

Title: Director of Security (Subcontract for Ark Technology Consultants)

Through Ark Technology Consultants (Ark) and Strategic Resource Services (SRS), we offer custom talent solutions to help our clients meet their evolving technology and business needs. We help effectively match the right technology professional to their organization, recruiting for contract, contract-to-hire, and direct roles. Please note that this is a (contract/contract to hire/direct hire) opportunity with our client and NOT with Ark.

Position Summary

The Director of Security is accountable for the strategy, operation, and continuous improvement of Client’s information security and compliance program. This role leads a team of security and compliance professionals while remaining hands-on in incident management, threat and vulnerability management, identity and access governance, and audit readiness.

The ideal candidate combines deep technical security expertise with proven leadership and exceptional communication skills. Success in this role requires the ability to translate complex risk into clear business terms, build Board-ready presentations, and partner across engineering, IT, legal, and the executive team to keep Client secure and compliant.

Key Responsibilities

Security Leadership & Strategy

•                    Lead, mentor, and grow the security and compliance team, setting clear goals, priorities, and performance expectations.

•                    Define and execute a multi-year security strategy and roadmap aligned to business objectives and risk appetite.

•                    Own the security budget, tooling, and third-party security vendor relationships.

•                    Remain hands-on in architecture reviews, investigations, and technical remediation alongside the team.

•                    Incident Management

•                    Own the security incident response plan, playbooks, and on-call escalation procedures.

•                    Lead the detection, containment, investigation, and recovery of security incidents.

•                    Coordinate breach assessment and notification activities with legal and privacy in accordance with HIPAA requirements.

•                    Conduct post-incident reviews and drive corrective actions to prevent recurrence.

•                    Run regular tabletop exercises with technical teams and executive leadership.

•                    Threat & Vulnerability Management

•                    Operate the vulnerability management program across cloud infrastructure, endpoints, and applications.

•                    Prioritize remediation based on risk, exploitability, and business impact, and track to defined SLAs.

•                    Oversee penetration testing, threat intelligence, and security monitoring.

•                    Partner with engineering to embed secure development practices into the software delivery lifecycle.

•                    Access Reviews & Identity Governance

•                    Own periodic user access reviews for production systems, applications, and PHI-containing environments.

•                    Enforce least privilege, role-based access, and privileged access management controls.

•                    Ensure timely provisioning and deprovisioning aligned to joiner, mover, and leaver processes.

•                    Audit & Compliance

•                    Lead HITRUST, SOC 2, and HIPAA audits and assessments from scoping through final report.

•                    Serve as the primary point of contact for external auditors and assessors.

•                    Ensure controls are designed, implemented, and monitored on an ongoing basis, with evidence ready on demand.

•                    Track audit findings and drive remediation to closure.

•                    Executive & Board Communication

•                    Create clear, concise PowerPoint presentations for Board of Directors meetings on security posture, risk, incidents, and program progress.

•                    Present security and compliance updates to the Board and executive leadership.

•                    Develop security metrics and KPIs that communicate risk trends and program effectiveness.

•                    Communicate security expectations and awareness across the organization.

Required Qualifications

•                    Bachelor’s degree in Information Security, Computer Science, Information Technology, or related field, or equivalent work experience.

•                    10+ years of experience in information security, including 5+ years leading security and/or compliance teams.

•                    Hands-on experience with:

·               Security incident response and investigations

·               Vulnerability management and penetration testing

·               Identity and access management and access reviews

·               Cloud security (Azure preferred)

•                    Demonstrated experience leading HITRUST, SOC 2, and HIPAA audits.

•                    Strong working knowledge of HIPAA Security and Privacy Rules and the NIST Cybersecurity Framework.

•                    Experience preparing and presenting materials to executive leadership and Boards of Directors.

•                    Proficiency in Microsoft PowerPoint and building executive-level presentations.

•                    Excellent verbal and written communication skills.

Preferred Qualifications

•                    Healthcare or health technology industry experience.

•                    Professional certifications such as CISSP, CISM, CCSP, or CISA.

•                    Experience with Microsoft security tools, including Defender, Sentinel, Entra, and Purview.

•                    Experience building a security program in a high-growth organization.

•                    Familiarity with SIEM, EDR, and cloud security posture management platforms.

Key Competencies

•                    Exceptional verbal, written, and presentation communication skills.

•                    Ability to translate technical risk into business-friendly language for executives and the Board.

•                    Hands-on technical depth paired with strategic thinking.

•                    Calm, decisive leadership during incidents and under pressure.

•                    Strong team-building, coaching, and talent development skills.

•                    Strong collaboration and relationship-building across all levels of the organization.

•                    High integrity and sound judgment with sensitive information.

•                    Strong organizational and time management skills.

Success Metrics

•                    Successful HITRUST, SOC 2, and HIPAA audits with minimal findings.

•                    Timely detection, response, and resolution of security incidents.

•                    Vulnerability remediation completed within defined SLAs.

•                    Access reviews completed on schedule with exceptions remediated.

•                    Clear, well-received Board and executive reporting.

•                    An engaged, high-performing security and compliance team.