Senior Director of Cyber Security

Hornblower Group is a global leader in experience and transportation. Spanning a 100-year history, Hornblower Group’s portfolio of international offerings includes water- and land-based experiences and ferry and transportation services. City Experiences, Hornblower Group’s premier experience division, offers dining and sightseeing cruises and walking and food tours through the City Cruises, Walks, and Devour brands. City Ferry, part of Hornblower Group’s Ferry and Transportation Division, is the largest private operator of high-speed passenger and vehicle ferries in the United States, carrying more than 10 million passengers annually and operating services including NYC Ferry, Puerto Rico Ferry, and other regional ferry systems. Hornblower Group’s subsidiaries include Hornblower Marine, which provides vessel outhaul and maintenance services at Bridgeport Boatworks in Bridgeport, Connecticut, and Seaward Services, Inc., a full-service shipping, waterfront logistics and management company that specializes in the operation and maintenance of government and commercial vessels. Additionally, Anchor Operating System, LLC, a Hornblower Group subsidiary and independent entity, provides reservation, ticketing and website integration services for clients in the transportation, tourism and entertainment industries. Today, Hornblower Group’s global portfolio covers over 10 countries, over 50 U.S. cities and serves more than 20 million guests annually. Headquartered in Orlando, Florida, Hornblower Group’s additional corporate offices reside in San Francisco, California; Boston, Massachusetts; Chicago, Illinois; London, United Kingdom; New York, New York; Dublin, Ireland; and across Ontario, Canada. For more information, visit hornblowercorp.com.

Position Summary:

We are seeking a Senior Director of Cybersecurity to join our information security team. In this role, you will be responsible for the day-to-day leadership of Hornblower’s information security program. This position leads the internal security team, manages the company’s managed detection and response provider (MDR), and owns the compliance programs. The Senior Director of Cybersecurity sets the team’s direction for the CISO and executive leadership, while remaining hands-on with security tools and operations.

Duties and Responsibilities:

• Directs daily security operations, including alert triage, case management, and incident response.
• Ensures 24x7 security monitoring and response through internal staff and the MDR/MSSP provider, including on-call and escalation schedules. Manages the relationship against defined service levels and performance measures, including log source coverage, time to triage and escalation quality
• Serves as the senior escalation point for the security team, including outside of business hours.
• Produces KPI and metrics reporting on security operations for the CISO and executive leadership.
• Leads incident response from detection through recovery and post-incident review and conducts tabletop exercises at least annually.
• Oversees vulnerability assessment and management, including scanning, patch timelines, remediation tracking and reporting.
• Owns the security architecture and roadmap across identity, endpoint, email, network and cloud, using Microsoft 365 E5 as the core platform.
• Directs identity and access management for a large seasonal workforce, including Conditional Access, multi-factor authentication and timely offboarding.
• Secures a mixed environment of offices, ticket booths, shared kiosks, mobile ticket scanners and tablets, vessels, and IoT and OT systems.
• Evaluates the security tool portfolio to reduce overlap and cost.
• Leads the PCI DSS program for merchant and service provider obligations, and the SOC 2 program; supports ISO 27001 at the software business, with evidence reused across frameworks.
• Prepares documentation and responses for auditors, assessors and regulators.
• Maintains the enterprise security risk register and reports risk to the CISO, executive leadership and the board in business terms.
• Manages third-party risk for vendors that process payment and customer data.
• Supports compliance with maritime cybersecurity requirements for passenger vessels (33 CFR) in partnership with operations.
• Creates and maintains security operations procedures and runbooks that cover all workflows, reducing reliance on any one individual.
• Leads security awareness for a workforce that is largely seasonal and frequently works without a dedicated computer.
• Participates in IT and business projects that affect security.

Requirements & Qualifications:

• Eight or more years of information security experience, including at least three years leading a security team or function at a multi-site organization.
• Bachelor's degree in information security, computer science or a related field, or equivalent experience.
• Hands-on experience with Microsoft 365 E5 security capabilities, including Entra ID and Conditional Access, Defender XDR, Intune, Purview and Sentinel.
• Demonstrated experience managing an MDR or MSSP provider against service levels and measurable outcomes.
• Experience operating in a security operations center or 24x7 service environment, including working to SLAs.
• Strong knowledge of attack techniques, exploits and vulnerabilities, and experience with SIEM, log analysis and ticketing tools.
• Experience owning PCI DSS compliance as a merchant and leading SOC 2 audits, including evidence preparation and work with assessors.
• Experience leading incident response, including ransomware, phishing or social engineering incidents.
• Working knowledge of network security, including firewalls, intrusion detection and prevention, segmentation and secure remote connectivity.
• Strong analytical, leadership, coaching and performance management skills,with the ability to explain risk to non-technical executives.
• Willingness to participate in out-of-hours escalation for significant security incidents.

The RESPECT Service System embodies our mission, vision, values and operating principles. By creating a company culture that puts RESPECT at its core, we believe it will drive us to achieve our goal of becoming a Global Experiences and Transportation Leader.

EEO / Disabled / Protected Veteran Employer. Hornblower is proud to be an Equal Employment Opportunity employer. We offer equal employment opportunities to all qualified individuals and prohibit discrimination and/or harassment of any type, including but not limited to discrimination and or harassment based upon race, religion, religious creed, color, national origin, ancestry, citizenship, sex, sexual orientation, gender, gender identity, gender expression, age, pregnancy or relation medical conditions, childbirth, breastfeeding, parental status, veteran and/or military status, disability (physical or mental), medical condition, genetic information or characteristics, political affiliation, domestic violence survivor status, marital status, or other characteristics prohibited by federal, state, or local law. Additionally, as a federal, state, and local contractor, Hornblower complies with government regulations, including affirmative action responsibilities for qualified individuals, where and as they apply. The company also participates in the E-Verify program in certain locations.