Director of Information Security - Blue Bell, PA

The Director of Information Security is a senior, handson leader responsible for designing, implementing, and operating a comprehensive information security program across three affiliated companies. This role combines technical security leadership, risk management, and governance, risk, and compliance (GRC) oversight.

The ideal candidate is a playercoach who can lead a small team while remaining deeply engaged in daytoday security operations and architecture. This individual will serve as a trusted advisor to business leaders, management, and external clients, translating complex security risks into clear, actionable business terms.

• Lead and manage a small, highly technical information security team, providing mentorship, direction, and handson support.
• Design, implement, and maintain security controls across identity, endpoint, network, cloud, and SaaS environments.
• Provide direct technical oversight and escalation support for security incidents, investigations, and response activities.
• Ensure consistent security posture and standards across three separate companies while accommodating businessspecific needs.

• Act as a subject matter expert and handson contributor for core security platforms, including:




• Identity & Access Management: Okta, Azure AD
• Network & Cloud Security: Zscaler, Azure
• Productivity & SaaS Security: Microsoft 365
• Email Security: Proofpoint
• Endpoint Protection: CrowdStrike
• Security Monitoring & SIEM: Splunk




• Partner with IT and engineering teams to securely design and deploy cloud and hybrid environments.
• Continuously evaluate and enhance security tooling, configurations, and detection capabilities.

• Lead enterprise security risk assessments to identify, analyze, prioritize, and document information security risks.
• Clearly communicate risk exposure and mitigation strategies to nontechnical business users, executive management, and clients.
• Drive risk remediation efforts, tracking progress and ensuring accountability.
• Integrate security risk management into broader enterprise risk management processes.

• Own and operate the information security governance program, including policies, standards, procedures, and metrics.
• Ensure the design and effectiveness of IT General Controls (ITGCs).
• Support internal and external audits, including planning, evidence collection, remediation, and ongoing control improvements.
• Maintain compliance with applicable regulatory and contractual requirements, with emphasis on:




• State Department of Insurance (DOI) data security regulations
• New York Department of Financial Services (NYDFS) 23 NYCRR 500




• Partner with Legal, Compliance, and Audit teams to ensure alignment between security, regulatory, and business objectives.

• Serve as a key security liaison for:




• Nontechnical business staff
• Executive and senior management
• External clients, partners, and auditors




• Translate technical security concepts into clear, businessfocused language appropriate for each audience.
• Prepare and deliver security briefings, risk summaries, and compliance updates to leadership.
• Demonstrate commitment to Company's Code of Business Conduct and Ethics, and apply knowledge of compliance policies and procedures, standards and laws applicable to job responsibilities in the performance of work.

• Bachelor's degree in Information Security, Computer Science, Information Systems, or a related field (or equivalent experience).
• 8+ years of progressive experience in information security, including leadership or senior technical roles.
• Proven experience managing and mentoring small security teams.
• Strong handson technical expertise in:




• Okta, Zscaler, Azure, Microsoft 365
• Proofpoint, CrowdStrike, Splunk




• Demonstrated experience leading security risk assessments and remediation initiatives.
• Strong background in governance, risk, and compliance, including IT general controls and audit support.
• Experience working in regulated environments, preferably financial services or insurance.

Preferred Qualifications

• Prior experience supporting State Department of Insurance data security regulations.
• Direct experience with NYDFS 23 NYCRR 500 compliance.
• Audit background (internal audit, external audit, or security assurance).
• Relevant certifications such as CISSP, CISM, CRISC, CGEIT, or similar.

Key Competencies & Attributes

• Handson, pragmatic security leader with a strong bias toward execution.
• Excellent verbal and written communication skills.
• Ability to balance security rigor with business enablement.
• Strong organizational and prioritization skills across multiple companies and stakeholders.
• High integrity, sound judgment, and comfort operating with limited oversight.