Director Information Security

InterContinental Hotels Group; Atlanta (GA); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

IHG Hotels & Resorts is seeking a Director of Information Security to set enterprise security controls, policy management, and AI governance. You will drive regulatory compliance (PCI DSS, IT SOX, SOC 1/2, SWIFT), own policy lifecycle, and lead AI guardrails.

Leading a blended onshore/offshore team, you will report to executive leadership and partner across Security, Legal, Privacy, Internal Audit, and Finance to embed governance into the business.

Qualifications

• Bachelor's degree in Information Systems, Business, or related field, or equivalent experience.
• 10+ years in security governance, risk, compliance, audit, or technology risk, including 5+ years leading teams.
• Deep expertise in regulatory compliance programs (PCI DSS, SOX/SOC, SWIFT) and control frameworks (NIST CSF/AI RMF, ISO 27001, COBIT).
• Proven ownership of enterprise policy lifecycle and governance forums with executive audiences.
• Experience establishing AI or emerging-technology governance, including risk tiering, guardrails, and responsible use enablement.
• Demonstrated executive communication: able to distill complex risk into crisp decisions for VPs, SVPs, and SteerCos.
• Experience leading blended onshore/offshore and managed-service delivery models.

Responsibilities

• Own enterprise regulatory compliance strategy and delivery across PCI DSS, IT SOX, SOC 1, SOC 2, and SWIFT, including scoping, audit planning, execution, and remediation.
• Maintain a unified control framework mapped across regulations and expand the controls library as scope grows.
• Drive continuous control monitoring and evidence automation through ServiceNow GRC and control indicators to reduce recurring findings and audit burden.
• Define control ownership and formalize executive accountability with VPs and SVPs across P&T and corporate functions.
• Mature the Compliance Partner model and control health dashboards, reporting posture and risk themes to executive leadership.
• Equip control owners with training, remediation guidance, and clear expectations for sustained control performance.
• Represent the function in the Financial Controls SteerCo, AI Responsible Use SteerCo, and VP Working Groups
• Set enterprise AI risk tolerance, guardrails, and escalation criteria aligned to NIST AI RMF, ISO/IEC standards, and the EU AI Act.
• Own the AI governance operating model covering intake, risk tiering, review, approval, exceptions, and ongoing monitoring.
• Steward AI governance forums and prepare SteerCo-level decisions, risk positions, and executive recommendations.
• Embed responsible use guidance and role-based enablement so AI adoption scales safely across the enterprise.
• Own the Enterprise Technology and Security policy lifecycle, including annual refresh, SteerCo review, publication and ongoing communications.
• Keep policies current and operationally feasible through regulatory mapping, gap analysis, and business consultation.
• Own the policy exception process and drive awareness through roadshows and role-based training.
• Align policies, standards, and controls so requirements are measurable, testable, and auditable.
• Lead a blended onshore and offshore team through a manager-led model, delegating delivery accountability to managers.
• Act as an advisor to managers and team members to help meet established schedules and/or resolve technical or operational problems.
• Own workforce planning, sourcing mix, budget input, vendor performance, and talent development across the function.
• Partner across Security, Legal, Privacy, Internal Audit, Finance, and P&T to embed compliance and governance into the business.

Skills

Security governance

Regulatory compliance

Risk management

Audit

Team leadership

Education

Bachelor's degree in Information Systems, Business, or related field

Tools

ServiceNow GRC/IRM

Veza

Axonius

Job description

IHG Hotels & Resorts is hiring a Director of Information Security. In this role you will set the standards for enterprise security controls and compliance, security policy management, and AI governance programs. You’ll establish direction for regulatory compliance (PCI DSS, IT SOX, SOC 1, SOC 2, SWIFT), owns the security policy lifecycle, and establishes responsible AI guardrails.

Drives executive accountability for control health with VPs and SVPs, represents the function in strategic governance forums (Financial Controls SteerCo, AI Responsible Use SteerCo, AI Working Group), and runs a blended onshore/offshore team through a manager-led model.

Your Day to Day

• Own enterprise regulatory compliance strategy and delivery across PCI DSS, IT SOX, SOC 1, SOC 2, and SWIFT, including scoping, audit planning, execution, and remediation.
• Maintain a unified control framework mapped across regulations and expand the controls library as scope grows. Own auditor and assessor relationships and hold delivery to agreed milestones and quality standards.
• Drive continuous control monitoring and evidence automation through ServiceNow GRC and control indicators to reduce recurring findings and audit burden.
• Define control ownership and formalize executive accountability with VPs and SVPs across P&T and corporate functions.
• Mature the Compliance Partner model and control health dashboards, reporting posture and risk themes to executive leadership.
• Equip control owners with training, remediation guidance, and clear expectations for sustained control performance.
• Represent the function in the Financial Controls SteerCo, AI Responsible Use SteerCo, and VP Working Groups
• Set enterprise AI risk tolerance, guardrails, and escalation criteria aligned to NIST AI RMF, ISO/IEC standards, and the EU AI Act.
• Own the AI governance operating model covering intake, risk tiering, review, approval, exceptions, and ongoing monitoring. Steward AI governance forums and prepare SteerCo-level decisions, risk positions, and executive recommendations.
• Embed responsible use guidance and role-based enablement so AI adoption scales safely across the enterprise.
• Own the Enterprise Technology and Security policy lifecycle, including annual refresh, SteerCo review, publication and ongoing communications.
• Keep policies current and operationally feasible through regulatory mapping, gap analysis, and business consultation.
• Own the policy exception process and drive awareness through roadshows and role-based training.
• Align policies, standards, and controls so requirements are measurable, testable, and auditable.
• Lead a blended onshore and offshore team through a manager-led model, delegating delivery accountability to managers.
• Act as an advisor to managers and team members to help meet established schedules and/or resolve technical or operational problems.
• Own workforce planning, sourcing mix, budget input, vendor performance, and talent development across the function.
• Partner across Security, Legal, Privacy, Internal Audit, Finance, and P&T to embed compliance and governance into the business.

What We Need from You

• Bachelor's degree in Information Systems, Business, or related field, or equivalent experience.
• 10+ years in security governance, risk, compliance, audit, or technology risk, including 5+ years leading teams and managing through managers.
• Deep expertise in regulatory compliance programs (PCI DSS, SOX/SOC, SWIFT) and control frameworks (NIST CSF/AI RMF, ISO 27001, COBIT).
• Proven ownership of enterprise policy lifecycle and governance forums with executive audiences.
• Experience establishing AI or emerging-technology governance, including risk tiering, guardrails, and responsible use enablement.
• Demonstrated executive communication: able to distill complex risk into crisp decisions for VPs, SVPs, and SteerCos.
• Experience leading blended onshore/offshore and managed-service delivery models.

Preferred Qualifications

• GRC tooling depth (ServiceNow GRC/IRM, Veza, Axonius).
• Experience in a highly regulated, global, or consumer/hospitality enterprise.
• Certifications such as CISA, CISM, CRISC, CISSP, or AI governance credentials (e.g., AIGP).
• Executive influence without authority; strategic thinking with operational rigor; change leadership; talent development; evidence-minded and audit-ready follow-through.

Travel

Limited 10%

Location

Our hybrid work structure is an expectation of three (3) days a week in the ATLANTA office.This expectation may be adjusted with the changing needs of the business.

#LI-ZY1