Director of IT Security (Remote Canada)

Director of IT Security — Job Description Directive Consulting is the leading B2B marketing agency for brands that are serious about the metrics that matter most. With over a decade of expertise and 420+ B2B brands under our belt, we've earned our reputation on real outcomes. We run through 3 divisions: Performance, Communications, and Commerce, all wired to share intelligence and answer to revenue. We move fast. We think boldly. We hire people who challenge the status quo, build campaigns worth talking about, and make bold brands impossible to ignore. The Role This role reports to the Head of Finance and is responsible for leading Directive's information security strategy across our fully remote workforce operating in the United States, Canada, Mexico and the United Kingdom. As the Director of IT Security, you will establish and continuously mature our cybersecurity program, protecting our people, client data, business operations and technology ecosystem from evolving cyber threats. You will proactively identify and mitigate cyber risks, strengthen our security posture, oversee compliance initiatives and prepare the organization to respond effectively to evolving threats. You will work closely with our leadership team to ensure security is embedded into every aspect of our business while enabling continued growth and innovation. Roles & Responsibilities Cybersecurity Strategy and Governance: - Develop and execute the company's information security strategy and scalable security roadmap.

• Establish and maintain enterprise security policies, standards and governance frameworks.
• Present cybersecurity risks, recommendations and security metrics to executive leadership.
• Partner with department leaders to ensure security is integrated into business operations and decision-making.
• Stay ahead of emerging cybersecurity threats, AI risks and industry best practices.

• Build and maintain the organization's cybersecurity risk register and remediation roadmap.
• Lead vulnerability management efforts and prioritize remediation based on business risk.
• Perform third-party vendor security assessments and ongoing vendor risk management.
• Continuously evaluate new technologies and recommend security improvements.
• Configure and enforce data governance policies across distributed tools (Notion, Drive, Stratos) to prevent data silos.
• Manage device security policies using MDM software (Kandji) to protect company assets.

• Oversee endpoint security, identity and access management, privileged access controls, MFA and device security.
• Partner with the Senior IT Manager to implement technical security controls and monitor the health of the environment.
• Coordinate with external security vendors and managed security providers when necessary.
• Develop and oversee business continuity and disaster recovery planning.

• Own customer security questionnaires and support enterprise sales opportunities by demonstrating Directive's security posture.
• Partner with Legal, Insurance, and Finance on privacy, data governance, and regulatory compliance.
• Maintain documentation for security policies, controls, audits, and evidence collection.

• Promote a security-first culture across the organization.
• Educate employees on evolving cybersecurity threats, social engineering, AI usage and data protection best practices.
• Establish security metrics and regularly report organizational security maturity.

• 3+ years leading enterprise security programs or security teams.
• Demonstrated experience performing cybersecurity risk assessments and threat modeling.
• Strong knowledge of cloud-first and SaaS-based environments including Google Workspace, Salesforce, NetSuite, Okta and modern identity platforms.
• Experience implementing and maintaining security frameworks such as SOC 2, ISO 27001 or the NIST Cybersecurity Framework.
• Deep understanding of endpoint security, identity management, vulnerability management, incident response and security operations.
• Experience working within fully remote organizations supporting distributed workforces.
• Strong executive communication skills with the ability to translate technical risk into business impact.
• CISSP, CISM, CRISC, or equivalent cybersecurity certification is strongly preferred.

• Complete enterprise-wide risk and threat assessments, resulting in prioritized remediation plans for critical vulnerabilities.
• Maintain successful SOC 2 compliance and establish audit readiness across all security controls and documentation.
• Reduce organizational cybersecurity risk through stronger identity management, endpoint protection, and security governance.
• Build a proactive security awareness program that significantly reduces phishing susceptibility and increases employee security engagement.
• Establish measurable security KPIs and provide regular executive reporting on risks, trends, and program maturity.
• Create a resilient incident response and disaster recovery program that enables the business to respond confidently to security events with minimal operational disruption.
• Become a trusted strategic partner to executive leadership by balancing strong security practices with business agility and growth.

• 🙏 Medical, dental, vision plans, disability, and life insurance coverage for you and your family that fit your lifestyle - Including a 100% employer-paid plan for you and a 50% employer contribution for your dependents - Benefits to Support the Whole Person: - 🧠 Mental - Access to certified therapists through Spring Health, membership to Headspace - 💪 Physical - Physical therapy through Omada, fertility support through Carrott, thousands of Aaptiv virtual workouts, complimentary One Medical membership for primary and virtual care - 🛫 Time Off - Unlimited PTO (2-week minimum), Paid Company Holidays, Your Birthday Off, End of Year Recharge (Closed December 24 - January 1), Paid Parental Leave - 💰 Financial - Traditional and Roth 401(k) with a 3% company match - 🌟 Bonus - Annual bonus based on tenure, which scales in total amount over time Work Environment Requirements As a remote-first company, you’ll have the ability to work from anywhere in the US, with the option to enjoy our state-of-the-art offices in Irvine, California.

• Ensure your resume highlights specific experience with cybersecurity strategy development and execution, especially in remote or distributed environments.
• Prepare examples of how you've communicated complex technical information to non-technical stakeholders, as this is a critical aspect of the role.
• Familiarize yourself with Directive's divisions (Performance, Communications, Commerce) and be ready to discuss how your cybersecurity expertise can support their operations.
• Develop a portfolio that includes examples of security policies, risk assessments, and compliance initiatives you've led or been a part of.
• During the interview, ask about the current state of Directive's cybersecurity posture and how you can contribute to its improvement.
• Be prepared to discuss your experience with tools like Salesforce, MDM software, and data governance platforms, and how you've used them to enhance security.