Skip to Job Description
Senior Director, Information Security
Partners In Health (PIH)
Director and Top Executive Full-time
Information and Communication TechnologyManagement and StrategySecurity and Safety
Trending
Apply Now
Plan Next Steps
Posted 2 days ago
Job Description

Description

Position Title: Senior Director, Information Security
Reports to: Managing Director, Strategic Information Systems
Location: Employees in this role can work from our Boston, MA office, remotely within the U.S. or hybrid of these two options (5-10% travel)
Position Type: Full-Time, Regular, Exempt, 40 hours/week
Position Overview
The Senior Director, Information Security serves as Partners In Health’s senior‑most cybersecurity leader, accountable for the integrity and resilience of PIH’s global security posture. This role functions as PIH’s information security officer, setting enterprise‑wide cyber strategy, defining acceptable risk, and ensuring alignment with the NIST Cybersecurity Framework across all platforms and care delivery sites.

In this capacity, the Senior Director, Information Security will own the comprehensive security and compliance landscape, serving as the subject matter expert for risk management and policy development. This role will drive the continuous evolution of our GRC maturity, establishing the frameworks required to identify coverage gaps and ensuring that all security standards are robustly documented, maintained, and adhered to across the organization. In continuous collaboration with the Senior Director, Global IT and the Senior Director, Enterprise Systems, the Senior Director, Information Security will be responsible for defining and driving a prioritized list of security improvements across the organization and for reporting to executive leadership on progress maintaining and improving the organization’s cybersecurity posture over time.

This role demands a seamless integration of policy leadership and technical execution. As a hands-on technical lead, the Senior Director, Information Security will design the security architectures, automated workflows, and system baselines that enforce these policies technically. The Senior Director, Information Security is the designated owner for organizational risks, responsible for working directly with U.S. and global care delivery IT teams to translate high-level compliance requirements into concrete infrastructure configurations, ensuring our security posture is defensible, documented, and resilient. Given the existential risk that cyber threats pose to global health operations, this role is entrusted with safeguarding systems that underpin patient care, supply chains, and sensitive health data in every geography where PIH operates.

Responsibilities
Team & Program Management (40%)
  • Manage a team dedicated to leading cybersecurity initiatives for the organization—this will include several direct reports as well as dotted-line technical oversight of IT colleagues implementing cybersecurity policies globally.
  • Lead the strategic alignment of the organization to the NIST CSF by developing and maintaining a robust policy library, ensuring operational procedures map directly to compliance standards.
  • Establish a continuous compliance and audit process, creating and managing Plans of Action and Milestones (POA&M) to track and remediate security risks identified through ongoing assessments.
  • Establish, maintain, and regularly communicate results of an organization-wide cybersecurity scorecard, based on key performance indicators aligned with prioritized cybersecurity threat scenarios.
  • Oversee the organizational Cyber Security Incident Response Plan (CSIRP), utilizing expertise in adversary methods to design relevant tabletop exercises and lead global response coordination.
  • Direct global security awareness and phishing simulation programs, utilizing data from real-world threats to customize training and drive behavioral change across the staff.
Technical Leadership (30%)
  • Act as the Incident Commander during critical security events. Direct the technical response, perform advanced root cause analysis, ensure threat containment, and author post-incident executive briefings.
  • Lead the implementation and optimization of the defensive stack (EDR/XDR, SIEM, and Vulnerability Management), ensuring maximum visibility and efficacy across on-premise and cloud environments.
  • Responsible for integrating security throughout the Software Development Life Cycle (SDLC) by conducting architectural reviews, performing SAST/DAST testing, and partnering with engineering teams to remediate vulnerabilities.
  • Conduct technical gap analyses and security assessments against industry benchmarks (NIST CSF), coordinating directly with infrastructure teams to prioritize and remediate hardened configurations.
  • Lead technical initiatives for Identity and Access Management (IAM) and Privileged Access Management (PAM), designing controls to prevent credential theft and lateral movement.
  • Translate audit findings and threat intelligence into actionable engineering projects, bridging the gap between high-level compliance requirements and technical implementation.
  • Represent PIH in relevant cybersecurity partnerships, vendor relationships, and sector working groups, ensuring our approach reflects both best practice and the realities of global health delivery in lowresource settings.
Infrastructure Security (30%)
  • Implement and maintain configuration management workflows (utilizing tools like Ansible, Chef, or native cloud tools) to standardize deployments.
  • Provide subject matter expertise in securing and managing hybrid infrastructure environments (VMware, Azure, AWS), ensuring secure architecture for system workloads.
  • Collaborate with the infrastructure team to operationalize vulnerability data, prioritizing and automating patch management processes with defined Service Level Agreements (SLAs).
  • Maintain the health and performance of underlying infrastructure supporting critical security tools (e.g., log forwarders, SIEM collectors, jump hosts), ensuring high availability and reliable telemetry for threat protection.
  • Leverage scripting languages (PowerShell, Python) to automate the application of security baselines across server and endpoint environments to ensure continuous compliance with NIST CSF standards.
Required Experience, Education, Licenses or Certifications
  • 12+ years of progressive experience in Information Security, Information Systems, or Systems Engineering, including at least 4 years leading cybersecurity programs, security architecture, or security operations at the organizational or regional level.
  • Experience with NIST, CIS, CMMC, ISO 27001/2, GRC frameworks and their implementation process.
  • At least one advanced Information Security Certification (e.g., CISSP, CISM, or equivalent).
Skills
  • Required: In-depth knowledge of computer and network systems. Ability to describe technical information in easy-to-understand terms. Network design/implementation and tools, NIST Cybersecurity Framework, MITRE ATT&CK Framework, IDS/IPS, EDR, SIEM. Experience working in an enterprise level cybersecurity environment. Strong attention to detail and ability to work across multiple time zones.
  • Preferred: Experience working with Linux environments, Python, log querying language (e.g., KQL/SPL), Shell Scripting, Docker. Project management experience is a plus.
We recognize at PIH that all candidates may not have 100% of the above-mentioned skills. You are still encouraged to apply if you believe your skills and experience are well-placed to meet the needs of this role.
Core Values and Competencies
  • Demonstrates the organization’s core values of: Commitment, Humility, Integrity and Pragmatic Solidarity/Accompaniment.
  • Accountability – Able to accept responsibility for one's actions, outcomes, and those of their team.
  • Achieving results – Able to design and conduct work with clarity and integrity: to set realistic targets for themselves and others, ensure availability of resources, monitor progress and performance, accomplish meaningful outcomes, evaluate achievements, and integrate lessons learned.
  • Adaptability – Able to adapt to change, to balance multiple demands, consider new approaches, and persist towards solutions in changing circumstances.
  • Teamwork – Able to work well with others to achieve common goals. Exemplary interpersonal skills; ability to collaborate effectively with staff across departments and countries.
This vacancy may be used to fill similar positions.
Organizational Profile
Partners In Health (PIH) is a non-profit, global health organization that fights social injustice by bringing the benefits of modern medical science first and foremost to the most vulnerable communities around the world. PIH focuses on those who would not otherwise have access to quality health care. PIH partners with the world’s leading academic institutions to create rigorous evidence that shapes more sound and all-inclusive global health policies. PIH also supports local governments’ efforts to build capacity and strengthen national health systems.
As of today, PIH runs programs in 11 countries (Haiti, Kazakhstan, Lesotho, Liberia, Malawi, Mexico, Navajo Nation, Peru, Rwanda, Sierra Leone, United States), where it provides direct care to millions of patients, through public facilities and community engagement.
Partners In Health (PIH) is committed to the fundamental principle of equal opportunity and equal treatment for every prospective and current employee. It is the policy of PIH not to discriminate on the basis of race, color, national or ethnic origin, ancestry, age, religion, creed, disability, sex and gender, sexual orientation, gender identity and/or expression, military or veteran status, or any other characteristic protected under applicable federal, state or local law. PIH works in and with a number of governments in and outside the U.S., and to the extent applicable, this statement is intended to incorporate the prohibition of any unlawful discrimination covered by applicable laws in such countries, states and municipalities.
Partners In Health participates in E-Verify and will provide the federal government with your Form I-9 information to confirm that you are authorized to work in the U.S. If E-Verify cannot confirm that you are authorized to work, this employer is required to give you written instructions and an opportunity to contact Department of Homeland Security (DHS) or Social Security Administration (SSA) so you can begin to resolve the issue before the employer can take any action against you, including terminating your employment. Employers can only use E-Verify once you have accepted a job offer and completed the Form I-9. Any offer of employment is contingent upon the successful completion of applicable background checks.
Our Benefits Are Built for Real Life
We know you do your best work when you’re supported.
  • Work from anywhere in the U.S. for most roles, with flexibility baked into how we operate
  • Comprehensive health coverage (medical, dental, vision, disability, and life insurance) so you can focus on what matters
  • A 401(k) with automatic employer contributions to help you invest in your future
  • Flexible PTO with no cap, plus generous holidays, summer and winter breaks, and a sabbatical program
  • Professional development support and home office reimbursements to help you grow and work comfortably wherever you are
(Some roles may require specific locations or on-site presence. Benefits are subject to plan terms.)
The expected starting salary range for new hires in this position is between $130,000-160,000/year and may vary depending on multiple individualized factors, including market for the position, job-related knowledge, skills, and experience.
Partners In Health will ensure that persons with disabilities are provided reasonable accommodations for the hiring process. If a reasonable accommodation is needed, please contact: [email protected].





Position Title: Senior Director, Information Security

Reports to: Managing Director, Strategic Information Systems

Location: Employees in this role can work from our Boston, MA office, remotely within the U.S. or

hybrid of these two options (5-10% travel)

Position Type: Full-Time, Regular, Exempt, 40 hours/week

Position Overview

The Senior Director, Informaꢀon Security serves as Partners In Health’s senior-most cybersecurity leader,

accountable for the integrity and resilience of PIH’s global security posture. This role funcꢀons as PIH’s

informaꢀon security officer, seꢁng enterprise-wide cyber strategy, defining acceptable risk, and ensuring

alignment with the NIST Cybersecurity Framework across all plaꢂorms and care delivery sites.

In this capacity, the Senior Director, Informaꢀon Security will own the comprehensive security and

compliance landscape, serving as the subject maꢃer expert for risk management and policy

development. This role will drive the conꢀnuous evoluꢀon of our GRC maturity, establishing the

frameworks required to idenꢀfy coverage gaps and ensuring that all security standards are robustly

documented, maintained, and adhered to across the organizaꢀon. In conꢀnuous collaboraꢀon with the

Senior Director, Global IT and the Senior Director, Enterprise Systems, the Senior Director, Informaꢀon

Security will be responsible for defining and driving a prioriꢀzed list of security improvements across the

organizaꢀon and for reporꢀng to execuꢀve leadership on progress maintaining and improving the

organizaꢀon’s cybersecurity posture over ꢀme.

This role demands a seamless integraꢀon of policy leadership and technical execuꢀon. As a hands-on

technical lead, the Senior Director, Informaꢀon Security will design the security architectures, automated

workflows, and system baselines that enforce these policies technically. The Senior Director, Informaꢀon

Security is the designated owner for organizaꢀonal risks, responsible for working directly with U.S. and

global care delivery IT teams to translate high-level compliance requirements into concrete

infrastructure configuraꢀons, ensuring our security posture is defensible, documented, and resilient.

Given the existenꢀal risk that cyber threats pose to global health operaꢀons, this role is entrusted with

safeguarding systems that underpin paꢀent care, supply chains, and sensiꢀve health data in every

geography where PIH operates.

Responsibilities

Team & Program Management (40%)

•

Manage a team dedicated to leading cybersecurity iniꢀaꢀves for the organizaꢀon—this will

include several direct reports as well as doꢃed-line technical oversight of IT colleagues

implemenꢀng cybersecurity policies globally.

•

Lead the strategic alignment of the organizaꢀon to the NIST CSF by developing and maintaining a

robust policy library, ensuring operaꢀonal procedures map directly to compliance standards.





•

•

Establish a conꢀnuous compliance and audit process, creaꢀng and managing Plans of Acꢀon and

Milestones (POA&M) to track and remediate security risks idenꢀfied through ongoing

assessments.

Establish, maintain, and regularly communicate results of an organizaꢀon-wide cybersecurity

scorecard, based on key performance indicators aligned with prioriꢀzed cybersecurity threat

scenarios.

•

•

Oversee the organizaꢀonal Cyber Security Incident Response Plan (CSIRP), uꢀlizing experꢀse in

adversary methods to design relevant tabletop exercises and lead global response coordinaꢀon.

Direct global security awareness and phishing simulaꢀon programs, uꢀlizing data from real-

world threats to customize training and drive behavioral change across the staff.

Technical Leadership (30%)

•

•

•

•

Act as the Incident Commander during criꢀcal security events. Direct the technical response,

perform advanced root cause analysis, ensure threat containment, and author post-incident

execuꢀve briefings.

Lead the implementaꢀon and opꢀmizaꢀon of the defensive stack (EDR/XDR, SIEM, and

Vulnerability Management), ensuring maximum visibility and efficacy across on-premise and

cloud environments.

Responsible for integraꢀng security throughout the Soꢄware Development Life Cycle (SDLC) by

conducꢀng architectural reviews, performing SAST/DAST tesꢀng, and partnering with

engineering teams to remediate vulnerabiliꢀes.

Conduct technical gap analyses and security assessments against industry benchmarks (NIST

CSF), coordinaꢀng directly with infrastructure teams to prioriꢀze and remediate hardened

configuraꢀons.

•

•

•

Lead technical iniꢀaꢀves for Idenꢀty and Access Management (IAM) and Privileged Access

Management (PAM), designing controls to prevent credenꢀal theꢄ and lateral movement.

Translate audit findings and threat intelligence into acꢀonable engineering projects, bridging the

gap between high-level compliance requirements and technical implementaꢀon.

Represent PIH in relevant cybersecurity partnerships, vendor relationships, and sector working

groups, ensuring our approach reflects both best practice and the realities of global health

delivery in lowresource settings.

Infrastructure Security (30%)

•

•

•

•

Implement and maintain configuraꢀon management workflows (uꢀlizing tools like Ansible, Chef,

or naꢀve cloud tools) to standardize deployments.

Provide subject maꢃer experꢀse in securing and managing hybrid infrastructure environments

(VMware, Azure, AWS), ensuring secure architecture for system workloads.

Collaborate with the infrastructure team to operaꢀonalize vulnerability data, prioriꢀzing and

automaꢀng patch management processes with defined Service Level Agreements (SLAs).

Maintain the health and performance of underlying infrastructure supporꢀng criꢀcal security

tools (e.g., log forwarders, SIEM collectors, jump hosts), ensuring high availability and reliable

telemetry for threat protecꢀon.

•

Leverage scripꢀng languages (PowerShell, Python) to automate the applicaꢀon of security

baselines across server and endpoint environments to ensure conꢀnuous compliance with NIST

CSF standards.





Required Experience, Educaꢀon, Licenses or Cerꢀficaꢀons

•

12+ years of progressive experience in Informaꢀon Security, Informaꢀon Systems, or Systems

Engineering, including at least 4 years leading cybersecurity programs, security architecture, or

security operaꢀons at the organizaꢀonal or regional level.

•

Experience with NIST, CIS, CMMC, ISO 27001/2, GRC frameworks and their implementation

process.

•

Skills

•

At least one advanced Information Security Certification (e.g., CISSP, CISM, or equivalent).

Required: In-depth knowledge of computer and network systems. Ability to describe technical

information in easy-to-understand terms. Network design/implementaꢀon and tools, NIST

Cybersecurity Framework, MITRE ATT&CK Framework, IDS/IPS, EDR, SIEM. Experience working in

an enterprise level cybersecurity environment. Strong aꢃenꢀon to detail and ability to work

across mulꢀple ꢀme zones.

•

Preferred: Experience working with Linux environments, Python, log querying language (e.g.,

KQL/SPL), Shell Scripꢀng, Docker. Project management experience is a plus.

We recognize at PIH that all candidates may not have 100% of the above-menꢀoned skills. You are sꢀll encouraged

to apply if you believe your skills and experience are well-placed to meet the needs of this role.

Core Values and Competencies

•

Demonstrates the organizaꢀon’s core values of: Commitment, Humility, Integrity and Pragmaꢀc

Solidarity/Accompaniment.

•

•

Accountability – Able to accept responsibility for one's acꢀons, outcomes, and those of their team.

Achieving results – Able to design and conduct work with clarity and integrity: to set realisꢀc

targets for themselves and others, ensure availability of resources, monitor progress and

performance, accomplish meaningful outcomes, evaluate achievements, and integrate lessons

learned.

•

•

Adaptability – Able to adapt to change, to balance mulꢀple demands, consider new approaches,

and persist towards soluꢀons in changing circumstances.

Teamwork – Able to work well with others to achieve common goals. Exemplary interpersonal

skills; ability to collaborate effecꢀvely with staff across departments and countries.

This vacancy may be used to fill similar posiꢀons.

Organizational Profile

Partners In Health (PIH) is a non-profit, global health organization that fights social injustice by bringing

the benefits of modern medical science first and foremost to the most vulnerable communities around

the world. PIH focuses on those who would not otherwise have access to quality health care. PIH




partners with the world’s leading academic institutions to create rigorous evidence that shapes more

sound and all-inclusive global health policies. PIH also supports local governments’ efforts to build

capacity and strengthen national health systems.

As of today, PIH runs programs in 11 countries (Haiti, Kazakhstan, Lesotho, Liberia, Malawi, Mexico,

Navajo Nation, Peru, Rwanda, Sierra Leone, United States), where it provides direct care to millions of

patients, through public facilities and community engagement.

Partners In Health (PIH) is committed to the fundamental principle of equal opportunity and equal

treatment for every prospective and current employee. It is the policy of PIH not to discriminate on the

basis of race, color, national or ethnic origin, ancestry, age, religion, creed, disability, sex and gender,

sexual orientation, gender identity and/or expression, military or veteran status, or any other

characteristic protected under applicable federal, state or local law. PIH works in and with a number of

governments in and outside the U.S., and to the extent applicable, this statement is intended to

incorporate the prohibition of any unlawful discrimination covered by applicable laws in such countries,

states and municipalities.

Partners In Health participates in E-Verify and will provide the federal government with your Form I-9

information to confirm that you are authorized to work in the U.S. If E-Verify cannot confirm that you

are authorized to work, this employer is required to give you written instructions and an opportunity to

contact Department of Homeland Security (DHS) or Social Security Administration (SSA) so you can begin

to resolve the issue before the employer can take any action against you, including terminating your

employment. Employers can only use E-Verify once you have accepted a job offer and completed the

Form I-9. Any offer of employment is contingent upon the successful completion of applicable

background checks.

Our Benefits Are Built for Real Life

We know you do your best work when you’re supported.

•

•

Work from anywhere in the U.S. for most roles, with flexibility baked into how we operate

Comprehensive health coverage (medical, dental, vision, disability, and life insurance) so you

can focus on what matters

•

•

A 401(k) with automatic employer contributions to help you invest in your future

Flexible PTO with no cap, plus generous holidays, summer and winter breaks, and a sabbatical

program

•

Professional development support and home office reimbursements to help you grow and work

comfortably wherever you are

(Some roles may require specific locations or on-site presence. Benefits are subject to plan terms.)

The expected starting salary range for new hires in this position is between $130,000-160,000/year and

may vary depending on multiple individualized factors, including market for the position, job-related

knowledge, skills, and experience.





Partners In Health will ensure that persons with disabilities are provided reasonable accommodations for

the hiring process. If a reasonable accommodation is needed, please contact: pihrecruitment@pih.org.


{{waiting}}
This position is no longer open.
Apply on Organization Website
UNjobnet Logo
Connect with us
Privacy Policy | About Us | For Employers