Director, IT Infrastructure and Security

Key Responsibilities

• Partner with the VP, IT and fractional CISO in setting the overall security strategy and policy; own the execution of the cybersecurity program, including the roadmap, risk register and NIST CSF 2.0 standards, and report cyber risk to leadership and the Board.
• Apply generative and agentic AI to security operations and risk insight, including NIST CSF 2.0 assessment, prioritized remediation, and continuous control monitoring.
• Oversee security operations, including threat detection and response, vulnerability and patch management, endpoint and email security, and incident response, working with MDR/MSSP partners.
• Own the identity and access management program, including conditional access, phishing-resistant MFA, MFA registration controls, and privileged access.
• Define secure architecture standards for cloud, network, identity, and data protection to safeguard intellectual property, clinical data, and corporate data.
• Partner with Legal, Quality, Data, and business leaders on responsible AI governance aligned to the NIST AI Risk Management Framework.
• Prepare Microsoft 365 for Copilot and AI, including SharePoint permissions, sensitivity labels, data loss prevention, and data classification.
• Oversee cloud and network operations, including Microsoft 365, LAN/WAN, wireless, firewalls and remote access for Carmel and Burlington offices and remote workforce.
• Lead Tier 1 and Tier 2 service desk operations, including endpoint and mobile device management, onboarding and offboarding, service levels, and end user experience.
• Build and scale ITIL-aligned IT processes, test backup, disaster recovery, and ransomware recovery annually, including executive incident response tabletops.
• Ensure IT systems, controls and documentation meet regulatory and audit requirements, such as GxP, 21 CFR Part 11, SOX IT general controls, and privacy laws.
• Prepare IT and security for regulatory inspections and commercial launch, including audit evidence and a risk-based computer system validation and change-control approach (Annex 11, data integrity).
• Own the multi-year infrastructure, operations and security roadmap and budget, prioritizing by business need and cyber risk, and report KPIs and risk indicators.
• Plan infrastructure and security for the shift from clinical to commercial stage, including new sites, CRO and CDMO data sharing, and expanded compliance scope.
• Consolidate and govern managed service, MDR/MSSP and service desk providers, including contracts, SLAs, budget, and third-party risk.
• Over time, hire, coach, and develop a high-performing team, and build a culture of security awareness, including phishing simulation and role-based training.

What You Bring

• Bachelor's degree in IT, Computer Science, Cybersecurity or a related field, or equivalent experience; advanced degree preferred.
• 10+ years of progressive experience in IT infrastructure, operations, and security, including at least 5 years in leadership.
• Demonstrated experience building and scaling IT operations in a regulated environment such as biotechnology, pharmaceuticals, life sciences, or healthcare; familiarity with GxP, 21 CFR Part 11, SOX and computer system validation preferred.
• Proven ability to run cybersecurity operations and partner with head of IT and fractional CISO on strategy, policy, and risk management, with working knowledge of NIST CSF 2.0, ISO 27001 or similar frameworks.
• Well versed in modern technologies, including generative and agentic AI, with practical experience applying AI to security operations and insight.
• Strong hands-on expertise in Microsoft 365, Microsoft Entra, Okta, Intune, Defender, Azure and other cloud platforms, identity and access management, endpoint management, enterprise networking and firewalls, and security monitoring and response tools such as SIEM and XDR platforms.
• Experience overseeing Tier 1 and Tier 2 service desk operations and outsourced providers, including MDR/MSSP relationships and ITSM tools such as Freshservice, ServiceNow.
• Experience with incident response, vulnerability management, vendor risk management, and audit readiness.
• Experience supporting regulatory inspections or audits, such as FDA pre-approval or BIMO inspections, in an IT or security capacity preferred.
• Understanding of the security, privacy and compliance risks of AI, and experience evaluating and safely deploying AI tools, such as Microsoft Copilot and security automation, in a regulated environment.
• Excellent communication skills, including the ability to translate technical risk into business terms for executives and the Board and to collaborate across functions.
• Certifications such as CISSP, CISM, CISA, CCSP, ITIL or Microsoft Azure preferred.