Information Security Director – ISD
Location
Virginia
Posted
1 day ago
Salary
$195K - $240K / year
Seniority
Lead
Job Description
Information Security Director – ISD
Redgrave LLP
• Define and execute a Firm-wide cybersecurity strategy aligned with NIST CSF, NIST AI RMF 1.0, ISO 27001, and SOC 2 frameworks • Own and continuously mature the Firm's Information Security Management System (ISMS) • Lead ISO 27001 gap analysis and establish a roadmap toward certification • Develop, maintain, and enforce security policies, standards, procedures, and governance structures • Define and track key risk indicators (KRIs), metrics, and reporting frameworks • Serve as the Firm's executive owner of AI security and governance • Design and implement a scalable AI governance framework, including acceptable use standards, risk-tiering criteria, and data handling controls • Own the Firm's vendor risk management program, including intake, risk-tiering, assessment, and continuous monitoring • Own the Firm's SOC 2 Type II program, including control maintenance, evidence collection, and auditor engagement • Provide executive oversight of security architecture across Microsoft 365 and Azure
Job Requirements
- 10+ years of progressive experience in information security, including leadership and program ownership roles
- CISSP (required); CISM or equivalent considered
- Demonstrated experience leading or scaling a security program; law firm or professional services preferred
- Strong experience with cloud security, vendor risk, and compliance frameworks
- Experience with SOC 2 programs and enterprise security tooling in Microsoft environments
Benefits
- medical, dental, and vision coverage
- 401(k) plan
- additional benefits to help you prepare for retirement
- free access to Employee Assistance Programs
- other programs designed to help you and your family stay healthy, feel secure, and enjoy a positive work/life balance
Related Guides
Related Categories
Related Job Pages
More Security Engineer Jobs
• Continuously monitor Claude and ChatGPT product roadmaps, release notes, and vendor communications to anticipate platform changes before they land • Translate upcoming features into proactive configuration, policy, and enablement decisions not reactive scrambles • Maintain active relationships with Anthropic and OpenAI account teams; flag ToS updates, data processing agreement changes, and acceptable use policy shifts before they become surprises • Provide expert-level administration of AI console environments across both platforms • Manage Claude and ChatGPT organizational settings files using Git, version-controlled, reviewed, and deployed like the infrastructure they are • Own API key lifecycle management and secrets hygiene for all AI integrations • Manage SSO/SCIM provisioning for AI platforms; ensure access is tight, auditable, and clean • Develop token tracking and financial dashboards so leadership actually knows what AI costs us by team, by use case, by month • Build anomaly detection on AI spend; if something spikes, you catch it before accounting does • Produce regular usage trend reports and ROI framing for leadership that goes beyond "we use AI a lot" • Build and maintain internal MCP servers that extend AI capabilities into our workflows securely • Be the in-house subject matter expert on agentic AI builds such as architecture, risk, failure modes, and the parts that go sideways in ways no one anticipated • Write code. Python and/or TypeScript. AI-augmented is fine (encouraged, even), but you need to own what ships • Identify and mitigate prompt injection risks in internal AI-powered tools • Ensure no sensitive or regulated data (PII, PCI, PHI) flows into AI prompts. Architect the guardrails, not just the policy • Maintain awareness of AI-specific incident response options; when something goes wrong with an AI integration, you're in the room • Serve as IT Engineering's primary liaison to the AI Adoption Committee bringing operational grounding to adoption decisions • Participate actively in the AI Working Group; connect platform capabilities to how the company actually uses them • Partner closely with the Governance & Trust team, who leads AI policy and governance. Your job is to be their technical counterpart by implementing, informing, and flagging issues, not owning the policy itself
Role Description Gritter Francona is seeking an IT Asset Management Program Manager to support a federal Information Technology Asset Management (ITAM) program. This role will serve as the primary client-facing lead and will oversee the successful delivery of program management support for an enterprise ITAM effort focused on strengthening asset accountability, lifecycle management, governance, reporting, and operational visibility. - Serve as the primary client-facing lead for day-to-day program execution and coordination with government stakeholders. - Manage delivery of program management support activities, including: - Project planning - Schedule management - Risk and issue tracking - Status reporting - Stakeholder communications - Oversee development, maintenance, and delivery of key project artifacts, including: - Project management plans - Work breakdown structures - Program schedules - Risk registers - Communication plans - Status reports - Meeting materials - Coordinate across project team members to ensure deliverables are accurate, timely, complete, and aligned with client expectations. - Monitor project performance against approved plans, milestones, and deliverable schedules; identify deviations and recommend corrective actions. - Lead recurring meetings, briefings, and working sessions with government and contractor stakeholders. - Support ITAM governance, policy, strategic planning, and program management activities across hardware asset management and software asset management workstreams. - Maintain visibility into program risks, issues, dependencies, action items, and decision points. - Ensure project documentation is organized, accessible, and maintained in accordance with client requirements. - Support audit readiness, compliance reviews, data calls, and leadership reporting as needed. - Promote consistent communication, accountability, and transparency across the project team. Qualifications - Bachelor’s degree. - Minimum of 8 years of relevant experience. - Experience managing federal IT, program management, or management consulting projects. - Experience leading client-facing project delivery, including: - Schedule management - Risk management - Issue management - Action item management - Deliverable management - Strong written and verbal communication skills, including the ability to prepare executive-level briefings, reports, and project documentation. - Experience coordinating cross-functional teams and managing multiple concurrent priorities. - Ability to work effectively with government stakeholders, technical teams, analysts, and subject matter experts. - Proficiency with Microsoft Office tools, including Word, Excel, PowerPoint, and Project. - U.S. citizenship required. Preferred Qualifications - PMP certification. - Lean Six Sigma experience. - Experience supporting IT Asset Management, Hardware Asset Management, Software Asset Management, IT governance, IT service management, or enterprise IT operations. - Experience supporting Department of Veterans Affairs or other federal civilian agency programs. - Familiarity with federal IT governance, compliance, audit readiness, and reporting requirements. - Experience developing or managing project management plans, integrated schedules, risk registers, stakeholder communication plans, and monthly status reports. - Experience working in remote delivery environments with geographically dispersed teams. Benefits - Health Care Plan (Medical, Dental & Vision) - Retirement Plan (401k, IRA) - Life Insurance (Basic, Voluntary & AD&D) - Paid Time Off (Vacation, Sick & Public Holidays) - Short Term & Long Term Disability - Training & Development
• be accountable for your sales target and overachieving on that sales target • work closely with a Sales Engineer and ensuring their time is used optimally
• Act as the primary Information Security advisor for assigned business units • Advise business leaders on cybersecurity, risk management, and compliance matters • Conduct risk and system assessments and recommend appropriate security controls • Translate technical risks into clear business impacts and actionable recommendations • Drive governance, risk, and compliance activities within the business units • Support vulnerability management, secure baseline adoption, and risk mitigation initiatives • Provide security expertise for customer engagements, sales activities, and audit processes • Support certification and regulatory compliance initiatives (e.g., ISO 27001, NIS2, CMMC, PCI DSS, GDPR) • Represent business interests within enterprise cybersecurity and IT discussions • Promote a risk-aware and security-focused culture across the organization




