Senior Director of Cybersecurity

Position Title Sr. Director of Cybersecurity

Reports To Chief Information Officer

Department Global Technology

Supervises YES

Date July 15, 2026

HR Number Position Summary Reporting to the Chief Information Officer, the Sr. Director of Cybersecurity is LifeWave's senior cybersecurity leader, responsible for a risk-based cybersecurity program that protects company assets while supporting innovation, international growth, regulatory compliance, and digital commerce. This role provides leadership for protecting the confidentiality, integrity, and availability of company information assets, business systems, digital commerce platforms, distributor systems, cloud services, and corporate infrastructure.

The Sr Director of Cybersecurity partners with the cybersecurity risk committee (CIO, Legal, Compliance) and works closely with executive leadership, legal, privacy, infrastructure, application development, and business stakeholders to assess and manage cyber risk. The position is accountable for enterprise security architecture, threat management, vulnerability management, cyber resilience, incident response, identity and access management, security awareness, third-party security risk management, and cybersecurity governance.

Success is measured through a secure, resilient, scalable, business-aligned cybersecurity program supporting LifeWave's operations across multiple international markets.

Supervisory Responsibilities

• Lead internal cybersecurity personnel and contractors.
• Manage relationships with managed security providers, MDR providers, vulnerability management partners, penetration testing firms, and cybersecurity consultants.
• Direct security architecture, security operations, security engineering, governance, risk, and incident response functions.
• Provide leadership and mentorship for security professionals globally.

Essential Duties and Responsibilities Cybersecurity Strategy & Governance

• Develop and maintain the enterprise cybersecurity strategy, roadmap, standards, and policies.
• Establish a risk-based cybersecurity program aligned to business objectives and organizational risk tolerance.
• Partner with executive leadership to ensure appropriate visibility into cyber risks and mitigation efforts.
• Create and maintain governance processes, reporting mechanisms, and executive dashboards; provide regular updates to the CIO, General Counsel, and Cybersecurity Risk Committee, and support the CIO in preparing periodic Board updates.
• Support the adoption and maintenance of security frameworks including ISO 27001, NIST, CIS Controls, and applicable regulatory requirements.
• Establish cybersecurity KPIs, performance metrics, and service-level objectives for internal teams and external providers.

Security Operations & Incident Response

• Direct enterprise security monitoring and detection capabilities through internal teams and managed security providers, including MDR, SIEM, EDR, and threat intelligence services.
• Establish and maintain incident response procedures, playbooks, and crisis management processes; lead investigations and coordinate response across business and technology teams.
• Conduct post-incident reviews and drive continuous improvement.
• Ensure appropriate logging, monitoring, and forensic capabilities exist across the organization.
• Establish governance and operational standards for Microsoft security capabilities, including Defender, Sentinel or equivalent SIEM integrations, Entra ID, conditional access, privileged access, endpoint protection, secure score management, and audit logging.

Vulnerability & Exposure Management

• Own the technology vulnerability management program, including scanning, remediation governance, prioritization, and reporting.
• Oversee external attack surface management and adversarial exposure validation.
• Establish risk-based remediation programs and service-level expectations.
• Track and report vulnerability trends, remediation performance, and risk posture.
• Coordinate remediation with infrastructure, cloud, application, and business teams.

Security Architecture & Engineering

• Establish enterprise security architecture standards and security design principles.
• Review major technology projects and ensure cybersecurity requirements are incorporated throughout the project lifecycle.
• Define secure architecture patterns for Microsoft 365 & Azure; SaaS E-commerce, ERP, and CRM systems; and internal and external AI.
• Lead implementation of zero-trust security principles across corporate systems and applications.
• Evaluate emerging cybersecurity technologies and make adoption recommendations.

Identity & Access Management

• Mature governance and controls for identity and access management, including Microsoft Entra ID, privileged access management, MFA, conditional access, joiner/mover/leaver processes, and identity governance.
• Ensure periodic access reviews and segregation-of-duty controls are maintained.

Governance, Risk & Compliance

• Develop and manage cybersecurity risk assessments across the enterprise; bring risk acceptance decisions above a defined severity/impact threshold to the CIO or risk committee for approval.
• Partner with legal, compliance, privacy, quality, and regulatory teams.
• Develop security standards supporting responsible adoption of AI technologies including Microsoft Copilot, generative AI platforms, AI governance, data protection, and emerging AI-related cyber risks.
• Support internal and external audits, and maintain cybersecurity metrics, risk reporting, and policy/control documentation.
• Manage cybersecurity policy lifecycle and related control documentation.
• Design, implement, monitor, and provide evidence for technical cybersecurity controls that support PCI-DSS, GDPR, CCPA, PIPEDA and similar
• Support cyber insurance renewal, underwriting evidence, and control validation, as well as executive attestations, audit evidence packages, and board-level risk reporting as requested by the CIO, General Counsel, or designated governance body.

Third-Party Risk

• Develop a vendor security assessment program.
• Evaluate cybersecurity risks associated with vendors, suppliers, service providers, and technology partners.
• Review security requirements in contracts and vendor agreements.
• Participate in acquisition, implementation, and onboarding reviews for new technology solutions.

Security Awareness & Culture

• Manage an enterprise security awareness program, including phishing simulation and training initiatives.
• Foster a culture of shared responsibility for cybersecurity across all business units.
• Develop executive and leadership-focused cyber-risk awareness programs.

Leadership & Financial Management

• Develop and manage cybersecurity budgets.
• Establish measurable cybersecurity objectives and key results.
• Lead strategic planning and workforce development activities.
• Build high-performing teams capable of supporting a global business environment.
• Ensure vendor accountability through defined KPIs, SLAs, and outcome-based performance measures.

Role Boundaries and Decision Rights

• Owns cybersecurity strategy, security architecture, technical security controls, vulnerability management, security monitoring, incident response coordination, identity security, and cybersecurity risk reporting.
• Has authority to require remediation of critical cybersecurity risks, establish minimum security standards, and elevate unresolved risks through executive governance.
• Partners with Legal, Compliance, and Privacy on regulatory interpretation, privacy obligations, breach notification decisions, external communications, and audit/compliance attestations.
• Partners with Infrastructure, Platform Engineering, Enterprise Applications, and IT Product teams to ensure secure design, implementation, operation, and remediation of technology platforms.
• May recommend risk acceptance, remediation plans, compensating controls, and escalation; formal acceptance of material cybersecurity risk requires approval by the CIO or designated governance body.
• Does not independently own privacy-law interpretation, regulatory filings, contractual legal positions, or final compliance attestations unless expressly delegated by executive leadership.

Qualifications and Experience

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or related field, or equivalent experience.
• 10+ years of progressively responsible cybersecurity experience including 5+ years leading cybersecurity programs and teams.
• Experience operating in a multinational organization.
• Comfortable operating as a hands on, execution oriented security leader in a growing organization, balancing program leadership with practical implementation, vendor oversight, and cross functional remediation follow through.
• Experience working with cloud security technologies, particularly Microsoft Azure and M365.
• Experience managing external cybersecurity service providers and remediation across teams that do not directly report to cybersecurity.
• Experience with enterprise SaaS, e commerce, cloud, and identity centric security environments

Preferred

• CISSP, CISM or similar certification
. click apply for full job details