Information Security Lead: Governance & Incident Response

William Blair; Chicago (IL); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k)

Paid time off

Job summary

William Blair is seeking an Information Security Lead to manage governance, incident response, and strategic risk across the firm. Reporting to the Director of Information Security, you will own policy framework, roadmap, and regulatory requests while coordinating with stakeholders to mitigate risk.

You will lead incident response operations, run tabletop exercises, oversee the security awareness program, and manage client and vendor security due diligence.

Qualifications

• Bachelor’s and/or Master’s degree in cybersecurity or a related field.
• 6–8 years of progressively responsible information security experience.
• Relevant certifications: CISSP, CISM, CISA, CRISC, GSEC, GCIH, CompTIA Security+, or PMP.
• Knowledge of NIST Cybersecurity Framework and risk governance.

Responsibilities

• Draft and maintain security policies, standards, and guidelines aligned with the firmwide framework.
• Lead governance maturity assessments and report status and risks.
• Manage incident response plans, runbooks, and ransomware templates.
• Coordinate regulatory, audit responses, and industry engagements.
• Oversee security awareness training and metrics.

Skills

Governance & risk

Incident response

Security awareness

Client & vendor due diligence

Regulatory & audit engagement

Risk assessment

Project management

Communication

Education

Bachelor’s or Master’s degree in cybersecurity or related field

Tools

Power BI

GRC platforms

Microsoft Office

Job description

William Blair is seeking an Information Security Lead to manage governance, incident response, and strategic risk across the firm. Reporting to the Director of Information Security, you will own policy framework, roadmap, and regulatory requests while coordinating with stakeholders to mitigate risk.

You will lead incident response operations, run tabletop exercises, oversee the security awareness program, and manage client and vendor security due diligence.