Head of Information Security & Privacy

Exponent; Phoenix (AZ); On-site; USD 180,000 - 240,000; Full time

Job summary

Exponent, a premier engineering and scientific consulting firm, is seeking a Director of Information Security in Phoenix, AZ. You will lead the Information Technology Team, reporting to the VP of IT, and drive a multiyear security strategy across cloud, identity, data and privacy.

You will own governance, incident response, third‑party risk, audits and privacy obligations, building a resilient program that aligns with client commitments and business objectives.

Qualifications

• Progressive leadership directing enterprise information security programs.
• Experience with ISO/IEC 27001 governance and audits; privacy familiarity preferred.
• Bachelor's degree in IT/cybersecurity or related field; CISSP or equivalent.

Responsibilities

• Develop and execute the multiyear security and privacy strategy, roadmap, operating model and investments.
• Lead ISO/IEC 27001 and 27701 governance; coordinate with Legal on obligations.
• Direct enterprise risk assessment, secure architecture across identity, cloud, network and data.
• Oversee incident response, threat detection, vulnerability management and forensics.
• Act as Data Protection Officer and privacy escalation authority.
• Own security assurance for client questionnaires, audits and third‑party risk.
• Establish metrics on risk, incidents, controls, audits and program maturity.
• Lead security and privacy team; manage budget, vendors and resources.

Skills

Leadership experience

Security strategy

Governance

Budget management

Vendor management

Incident response leadership

Executive communication

Risk management

Enterprise influence

Education

Bachelor's degree in IT/cybersecurity or related field

CISSP certification

Job description

Exponent, a premier engineering and scientific consulting firm, is seeking a Director of Information Security in Phoenix, AZ. You will lead the Information Technology Team, reporting to the VP of IT, and drive a multiyear security strategy across cloud, identity, data and privacy.

You will own governance, incident response, third‑party risk, audits and privacy obligations, building a resilient program that aligns with client commitments and business objectives.