Director of IT Security

About Directive Consulting

Directive Consulting is a premier B2B marketing agency specializing in measurable outcomes for over 420 brands across the US, Canada, Mexico, and the UK. With divisions in Performance, Communications, and Commerce, the company integrates intelligence to drive revenue and innovation.

Role Overview

Reporting to the Head of Finance, the Director of IT Security is responsible for defining and evolving Directive's cybersecurity strategy in a fully remote environment. This role protects personnel, client information, business systems, and technology infrastructure from cyber threats by identifying risks, enforcing compliance, and steering incident readiness.

Key Responsibilities

• Design and implement a comprehensive, scalable information security strategy and governance framework.
• Establish security policies, standards, and communicate security risks and metrics to executive leadership.
• Collaborate with leadership to integrate security within business operations and stay updated on emerging cyber and AI risks.
• Conduct organization-wide cybersecurity risk evaluations, maintain risk registers, and prioritize vulnerability remediation.
• Manage third-party vendor security assessments and continuous risk management.
• Oversee data governance policies and device security through tools such as Notion, Drive, Stratos, and Kandji MDM.
• Lead security operations, including incident response playbooks, tabletop exercises, endpoint protection, identity and access controls, and coordinate with external security vendors.
• Direct business continuity, disaster recovery, and compliance programs such as SOC 2 Type II certifications.
• Manage customer security assessments and support sales by showcasing security standards.
• Promote a proactive security culture through company-wide awareness, phishing training, and education on cybersecurity threats and best practices.
• Establish security metrics, KPIs, and provide regular reporting on security maturity and risks to executives.

Qualifications

• Minimum of 7 years in cybersecurity, information security, or risk management fields.
• At least 3 years leading enterprise-level security initiatives or teams.
• Proficient in cybersecurity risk assessments, threat modeling, and security frameworks like SOC 2, ISO 27001, or NIST.
• Experience with cloud-first/SaaS platforms including Google Workspace, Salesforce, NetSuite, Okta, and identity management systems.
• Deep knowledge of endpoint protection, identity management, vulnerability remediation, incident response, and security operations in distributed, remote environments.
• Excellent communication skills for translating complex security risks into business impact for leadership.
• Security certifications such as CISSP, CISM, or CRISC are highly preferred.

Success Indicators

• Development and execution of a robust cybersecurity roadmap enhancing Directive's security posture.
• Completion of comprehensive risk assessments with prioritized mitigation plans.
• Maintenance and achievement of SOC 2 compliance with prepared audit readiness.
• Reduction of enterprise cybersecurity risk via improved governance and technology controls.
• Deployment of effective security awareness programs reducing phishing risk and increasing employee engagement.
• Regular executive-level reporting of security KPIs, trends, and risk status.
• Establishment of resilient incident response and recovery protocols ensuring operational continuity.
• Build trusted advisory relationships with organizational leaders balancing security and business needs.

Benefits

• Competitive base salary ranging from $165,000 to $200,000 CAD annually, adjusted based on experience and skills.
• Comprehensive medical, dental, vision, disability, and life insurance plans with 100% employer coverage for employees and 50% for dependents.
• Supportive health and wellness benefits including access to therapy, physical therapy, fertility services, virtual workouts, and primary care memberships.
• Flexible time off policies comprising unlimited PTO with a minimum of two weeks, company holidays, birthday off, year-end closure, and paid parental leave.
• Financial benefits including traditional and Roth 401(k) plans with 3% company matching.
• Annual bonus incentives increasing with tenure.

Work Environment and Additional Details

This role is fully remote within Canada and requires authorized work status and permanent residency in the country. Collaboration occurs primarily via virtual tools such as Zoom and Slack. Candidates must have reliable internet and appropriate workspace to perform duties that often require prolonged stationary computer use.

Directive is committed to inclusivity and equal opportunity employment regardless of race, gender, disability, or other protected characteristics.