Executive Director, Information Security & IT Controls

LHH; Detroit (MI); On-site; USD 180,000 - 240,000; Full time

Job summary

LHH in the Detroit area seeks a Director of Information Security & IT Controls to lead enterprise security, technology risk, and controls programs.

You will develop security strategy, oversee IT general and application controls, IAM, vulnerability management, and audit support, partnering with finance, legal, and executives.

This role requires strategic leadership, hands-on execution, and the ability to align security with business goals in a regulated environment.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related discipline.
• Approximately 10+ years of progressive experience in information security, technology risk, IT controls, or related areas.
• Significant experience leading cybersecurity, technology risk, or controls teams.
• Experience operating within a complex corporate environment with formal audit and compliance requirements.
• Strong understanding of IT general controls, application controls, and technology controls supporting financial reporting.
• Hands-on leadership experience with control design, testing, remediation, and audit support.
• Strong knowledge of IAM, cybersecurity operations, vulnerability management, and governance.
• Experience communicating cybersecurity and technology risk to senior executives.
• Professional security or risk certification such as CISSP, CISM, CISA, or comparable credential.
• Demonstrated ability to build, mentor, and lead security and technology-risk professionals.

Responsibilities

• Develop and execute the organization's enterprise information security and technology risk strategy.
• Provide leadership across cybersecurity operations, security architecture, technology controls, and incident preparedness and response.
• Oversee IT general controls and application controls supporting regulatory and financial compliance requirements.
• Maintain an effective technology control environment and ensure controls remain documented, tested, and prepared for internal and external review.
• Lead identity and access management initiatives, including privileged-access security and identity governance.
• Oversee vulnerability management, endpoint protection, application security, and related security processes.
• Direct technology governance, risk, and compliance activities.
• Maintain programs covering third-party technology risk, security awareness, regulatory compliance, and security policy.
• Establish meaningful security and risk metrics and communicate technology risk to executive leadership.
• Partner with internal stakeholders on audit preparation, control testing, remediation activities, and technology-risk initiatives.
• Coordinate with external audit and other appropriate third parties on technology controls and security matters.
• Work closely with infrastructure, applications, engineering, and business teams to incorporate appropriate security and controls into technology initiatives.
• Recruit, develop, and retain a high-performing information security and controls team.
• Participate in enterprise technology planning, architecture, and leadership discussions.
• Continuously evaluate the organization's security posture and identify opportunities to strengthen security capabilities and reduce business risk.

Skills

Security leadership

IT risk management

Cybersecurity operations

Identity and access management

Vulnerability management

Audit support

Executive communication

Education

Bachelor's degree in Cybersecurity, IT, CS, or related

Job description

LHH in the Detroit area seeks a Director of Information Security & IT Controls to lead enterprise security, technology risk, and controls programs.

You will develop security strategy, oversee IT general and application controls, IAM, vulnerability management, and audit support, partnering with finance, legal, and executives.

This role requires strategic leadership, hands-on execution, and the ability to align security with business goals in a regulated environment.