Security Lead

What You'll Do The Security Lead is responsible for shaping and operating the organization's information security program. This is a hands-on leadership role that combines security strategy, governance, risk management, compliance, incident response, and day-to-day execution with a team of security professionals. The role partners closely with, Infrastructure, DevOps, Risk, Legal, leadership, and external security partners to reduce cyber risk while enabling the business. Responsibilities Security Strategy & Governance Develop and maintain a practical information security roadmap aligned with business priorities, client expectations, and organizational risk tolerance. Create, maintain, and operationalize security policies, standards, procedures, and control documentation. Use recognized frameworks such as NIST Cybersecurity Framework, CIS Controls, ISO 27001 concepts, and SOC 2 control expectations where appropriate. Define security program metrics, risk indicators, and reporting materials for executive leadership. Risk Management & Compliance Lead recurring cybersecurity risk assessments and maintain a prioritized risk register with remediation plans. Support client security questionnaires, vendor due diligence, cyber insurance requests, and audit evidence collection. Partner with business and technology owners to evaluate risk for new systems, vendors, integrations, and technology changes. Coordinate remediation of audit findings, assessment results, and control gaps. Security Operations & Incident Response Oversee day-to-day security operations, including monitoring, alert review, vulnerability management, endpoint protection, identity controls, and threat response. Own and maintain the incident response plan, escalation process, communication templates, and post-incident review process. Coordinate with internal teams and third-party providers such as MSSP, SOC, penetration testing firms, cyber insurance contacts, and outside counsel when needed. Lead or support tabletop exercises, phishing response, vulnerability remediation, and security improvement initiatives. Architecture, Cloud & DevSecOps Enablement Partner with Infrastructure, DevOps, application, and business technology teams to embed security into architecture, implementation, and change management. Advise on secure configuration for Microsoft 365, Azure, identity and access management, network security, endpoint security, cloud workloads, and SaaS platforms. Promote secure development, secure deployment, secrets management, least privilege access, logging, and configuration baselines. Evaluate security tools and processes for fit, cost, redundancy, and measurable risk reduction. Leadership, Communication & Security Culture Translate technical security risks into business language for senior leadership and stakeholders. Provide clear recommendations on security priorities, investment needs, and risk tradeoffs. Lead security awareness, phishing education, onboarding security training, and ongoing employee communications. Mentor technical team members and coordinate work across internal staff, contractors, and managed security providers. undefined Who You Are Qualifications Working knowledge of risk and control frameworks such as NIST CSF, CIS Controls, ISO 27001, SOC 2, or similar standards. Practical experience with Microsoft 365, Azure or cloud security concepts, identity and access management, endpoint protection, vulnerability management, and incident response. Ability to communicate security risks and recommendations clearly to both executive and technical audiences. Demonstrated ability to balance security requirements with business practicality in a professional services environment is preferred. CISSP, CISM, CRISC, Security+, Azure security, or other relevant security certifications. Experience supporting SOC 2, cyber insurance, client security reviews, regulatory inquiries, or external security assessments. Experience managing third-party security providers, MSSPs, SOC services, penetration testing firms, or security consultants. Experience building or formalizing a security program in a small or mid-size organization. Familiarity with data privacy, third-party risk management, AI governance, secure software delivery, or professional services compliance expectations. Education and Experience 4-8 years of progressive experience in cybersecurity, IT risk, infrastructure security, security operations, or a closely related technology function. 2+ years of experience leading security initiatives, coordinating cross-functional work, or managing security operations, compliance, or risk activities. Work Environment The work environment is a business office environment. There may be occasions travel to trainings, conferences, or client sites as required. Client offices and other facilities which may present a variety of work environments beyond a traditional business office environment and is characteristic of the conditions an employee encounters while performing the essential functions of this job. Evening and weekend coverage needed during peak seasons. On-call shifts and after-hours support as needed. Physical Demands The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Physical demands may include talking, hearing, sitting for extended periods, standing, walking, repetitive motion using a keyboard and telephone, and lifting and carrying supplies and equipment. The visual acuity requirements include viewing a computer monitor and extensive reading. Who We Are #LifeatCohen Sure, we like numbers. (But we’ll never treat you like one.) At Cohen & Co our foundational principles offer insight into how we achieve an inclusive, growth-oriented culture that fuels the success of our firm, our clients and our people. In particular, we honor our foundational principle of “great people first” by: Championing the importance of diversity, equity and inclusion by embracing the unique stories, backgrounds, perspectives and ideas that come from our people; and Offering a comprehensive and competitive Total Rewards package, which allows each employee to use the benefits that best suits their needs. Our offerings go beyond standard options, including time off outside of your standard PTO to give back to the community, annual discretionary merit increases and bonuses, talent development resources to tap into growth opportunities, and so much more! Learn More About Us! Discover our Passion, Purpose & Expertise Learn more about our Firm's culture Estimated Base Range: $115,000 - $130,000 *Base compensation offered to candidates are determined based on factors such as candidate's relevant skillset, experience, licensure, and certifications, as well as job responsibilities, geography, market considerations, and organizational needs. At Cohen & Co, we don't stop at setting ourselves apart by offering competitive base compensation. As part of our 'great people first' foundational principle, our firm offers a comprehensive and competitive Total Rewards package that allows each employee to design a package that best suits their needs and goes beyond standard options, including time off outside of your standard PTO to recharge and give back to the community, annual discretionary merit increases and bonuses, talent development resources to tap into growth opportunities. We are an equal opportunity employer and value diversity of thought and background to build an inclusive and energized culture and better meet the needs of our clients. Agency recruiters may not submit unsolicited candidate information or resumes to any Cohen & Co employee without a recruiting services contract first being entered into with the Cohen & Co Talent Acquisition Team; see policy here .