Group Director, Cyber Risk & Security Engineering

Brobston Group LLC; New York (NY); On-site; USD 180,000 - 240,000; Full time

Job summary

Brobston Group LLC leads a security engineering function to safeguard systems and embed security across digital and physical environments. You will drive risk assessment, prioritization, controls, and enterprise-wide security awareness with measurable outcomes.

As a technical leader, you will influence remediation, security strategy, and adoption of DevSecOps, IAM governance, and infrastructure-as-code across the organization.

Qualifications

• Minimum 10 years of cyber security engineering experience with hands-on leadership.
• Proven experience across cloud platforms (Azure, AWS, GCP) and security tech.
• Proficiency in secure software development, DevSecOps, and IaC.
• Deep knowledge of IAM, DLP, encryption, and secure communications.
• Experience applying NIST 800-53, ISO 27001, CIS; PCI DSS preferred.
• Bachelor’s degree and security certifications preferred.

Responsibilities

• Lead implementation and integration of security controls across cloud, network, endpoints, and physical environments.
• Develop and operate continuous risk assessment, monitoring, and remediation programs.
• Translate technical risks into actionable requirements for stakeholders across engineering, operations, retail, and legal.
• Build and scale security awareness and training programs to drive measurable behavior change.
• Drive identity and access governance, ensuring appropriate access while minimizing business friction.
• Embed security into CI/CD pipelines and infrastructure through DevSecOps and infrastructure-as-code practices.

Skills

Cloud platforms

Networks

Endpoints

SIEM

EDR

PAM

DevSecOps

Terraform

Ansible

IAM

DLP

Encryption

Secure communications

NIST 800-53

ISO 27001

CIS

PCI DSS

CISSP

CISM

CISA

Leadership

Education

Bachelor's degree in computer science or related field

Tools

Terraform

Ansible

Job description

Summary

Lead the cyber risk and security engineering function to safeguard systems and embed security across digital and physical environments. Collaborate cross-functionally to assess and prioritize risks, implement controls, and drive enterprise-wide security awareness and identity governance. Serve as a technical leader influencing security strategy, remediation, and measurable behavior change.

Responsibilities

• Lead implementation and integration of security controls across cloud, network, endpoint, and physical environments.
• Develop and operate continuous risk assessment, monitoring, and remediation programs.
• Translate technical risks into actionable requirements and influence stakeholders across engineering, operations, retail, and legal.
• Build and scale security awareness and training programs to drive measurable behavior change.
• Drive identity and access governance, ensuring appropriate access while minimizing business friction.
• Embed security into CI/CD pipelines and infrastructure through DevSecOps and infrastructure-as-code practices.
• Advise on compliance, apply industry frameworks, and act as a decisive technical leader within a matrixed organization.

Requirements

• Minimum 10 years of cyber security engineering experience with hands-on leadership in enterprise environments.
• Proven experience across cloud platforms (Azure, AWS, GCP), networks, endpoints, and security technologies such as SIEM, EDR, and PAM.
• Proficiency in secure software development, DevSecOps, and infrastructure-as-code (Terraform, Ansible).
• Deep knowledge of identity and access management, data loss prevention, encryption, and secure communications.
• Practical experience applying frameworks such as NIST 800-53, ISO 27001, and CIS; PCI DSS experience preferred.
• Bachelor’s degree in computer science or related field or equivalent experience; security certifications (CISSP, CISM, CISA) preferred.
• Strong communication skills with the ability to present technical risk to senior leadership.