Director, Information Security & Cyber Risk Management

Summary

As Director, Information Security & Cyber Risk Management you will be responsible for the information security of Hollister’s customers and Associates. You will direct and lead Hollister’s Information Security and Cyber Risk Management program globally, developing appropriate security controls for business partners and service providers.

You will ensure IT strategies, practices and principles have a strong emphasis on security, while also ensuring that new products and solutions meet business requirements while maintaining a strong security posture. You will also direct day to day security administrative activities ensuring the stable and secure operations of IT and related systems and components.

You will ensure security compliance through audits, risk assessments and issue management in order to maintain a compliant, audit ready posture. This role also acts as a core team member of the Hollister Technical Review Board and the overall Global IT Leadership team.

You will also proactively work across the enterprise including sister companies as needed to ensure threat indicators are rated by severity and responded to in a manner consistent with the threat. You will also develop security policies and procedures for our global affiliated companies.

Hollister Incorporated operates in a hybrid work environment. Associates are expected to come into the office in Libertyville, IL a minimum of 4 days per week.

Responsibilities

• Direct the enterprise-wide Information Security and Cyber Risk Management function, ensuring a consistent, high-quality security program aligned with business goals.
• Develop, manage, and continuously improve a comprehensive, risk-based information security program that protects the confidentiality, integrity, availability, and privacy of information assets.
• Identify, assess, prioritize, and mitigate cybersecurity risks, including external and internal threats, cybercrime, third-party risks, and risks associated with emerging technologies. Advise stakeholders on appropriate risk mitigation strategies.
• Define and maintain enterprise and cloud security architecture, strategy, guiding principles, technical standards, controls, and roadmaps. Provide security thought leadership across cloud domains and evaluate emerging technologies to advance the organization’s future-state security architecture.
• Partner with Enterprise Architecture, IT, business leaders, and project teams to evaluate technologies and ensure security and privacy requirements are incorporated into business and technology initiatives.
• Direct and approve information security system designs, security and privacy impact assessments, and risk assessments. Review findings and ensure identified vulnerabilities and risks are appropriately addressed.
• Lead security and privacy compliance, monitoring, and assurance activities. Sponsor audits, oversee remediation, and support compliance with applicable regulatory requirements and internal control frameworks to maintain an audit-ready posture.
• Maintain the enterprise security risk management framework to ensure consistent, risk-based decisions supporting system protection, information integrity, availability, privacy, and regulatory compliance.
• Lead Identity and Access Management (IAM) initiatives, including identity management, provisioning, authentication, authorization, monitoring, certification, auditing, and reporting.
• Coordinate security and disaster recovery planning to support timely recovery of business-critical services following security or disaster events.
• Monitor emerging threats and vulnerabilities, recommend appropriate responses, and lead security initiatives to protect enterprise infrastructure and information assets.
• Lead Associate security education and awareness programs and advise stakeholders on security risks, policies, procedures, vulnerabilities, and best practices.
• Provide Information Security and Cyber Risk Management leadership to the Technical Review Board (TRB), reviewing and approving proposed technologies and representing security, cyber risk, and data privacy requirements.
• Identify and sponsor initiatives that advance the future-state security architecture. Develop initial business cases, define objectives, establish risk-based priorities, and escalate significant issues and risks as appropriate.
• Lead and develop the security team, including performance management, resource and capability planning, and prioritization of resources to effectively meet business needs.
• Oversee enterprise security technologies and operational controls, including endpoint protection, threat detection and prevention, system patching, and related security systems.
• Continually evaluate security processes, technologies, and methods to improve the effectiveness and efficiency of Information Security and Cyber Risk Management.

Essential Functions of the Role

Education & Work Requirements

Education & Work Preferences

• 15+ years of diverse and progressive IT experience
• 10+ years Information Security and Cyber Risk Management leadership experience
• 7+ years people management experience
• BS/BA Computer Science or equivalent related field of study
• An industry leading security certification required such as Certified Information Systems Security Professional (CISSP) or equivalent.
• Experience in Cloud and Privacy.
• Passion for technology and technical depth to uncover root causes of complex technical problems and provide guidance on solving them.
• Ability to build relationships and lead through influence, both with internal and external stakeholders.
• Ability to inspire and motivate a Security Engineering team to work together as a cohesive and highly productive unit.
• Ability to provide detailed technical guidance to the team, enabling them to execute more effectively and deliver products on time and within budget.
• Excellent communication skills with the ability to act as a thought leader in strategy discussions.
• Knowledge and demonstrated experience of relevant legal and regulatory requirements, such as HIPAA Privacy & Security, GDPR and other CMS regulations and guidelines.
• Knowledge of common information security management frameworks.

Competencies