Information Security Officer

Jobtailor; Massachusetts; On-site; USD 200,000 - 320,000; Full time

Job summary

Sompo is seeking a senior Information Security leader to manage and continuously modernize a global information security program. You will align security with external and corporate requirements, oversee security for thousands of users and devices, and sustain incident response and threat intelligence operations.

The role requires managing a hybrid team, driving metrics, and coordinating across technology stacks including Windows, cloud, and SaaS environments.

Qualifications

• Bachelor's degree in computer science, information security, or a related field.
• Experience integrating regulatory requirements, corporate policies, and industry standards into operating procedures.

Responsibilities

• Lead and manage a hybrid team of direct reports, matrix reports, managed services, and contractors.
• Oversee security program modernization across Windows, cloud, and SaaS environments.
• Develop and communicate security KPIs and risk metrics to executives.

Skills

Security architecture

Risk management

Cloud security

Security patterns

Vulnerability assessment

Incident response

Education

Bachelor's degree in computer science, information security, or a related field

Tools

DevSecOps tooling

Vulnerability management tools

Security monitoring systems

Incident response tools

Job description

• Manage and continuously modernize Sompo's Information Security program for global operations
• Maintain alignment with external and corporate requirements
• Manage security for more than 7,000 users, hundreds of developers and IT staff, more than 10,000 network devices, and 75+ physical and cloud locations
• Maintain technical security controls across all systems and processes, including malicious activity prevention and detection, encryption, data loss prevention and detection, activity/audit logging, and adversarial simulation
• Detect, report, and elevate vulnerabilities to operational teams
• Maintain organization-wide vulnerability data for periodic and threat-driven real-time reporting
• Operate an efficient, instrumented, and evolving security alerting function
• Maintain an efficient and tested incident response procedure capable of handling events of any scale
• Participate in the systems development lifecycle to ensure alignment with the information security program
• Establish a communications program covering emerging threats, policy changes, achievements, and security recommendations
• Lead and manage a hybrid team of direct reports, matrix reports, managed services, and specialist contractors

Requirements

• Minimum of 15 years of experience in a combination of technical, security, and risk management roles
• Minimum of 7 years in a senior management role within an information security function
• Technical familiarity with security patterns, operations and controls for traditional (Windows), cloud, and SaaS environments
• Systematic thinking and ability to understand security controls within the larger operating environment
• Ability to structure projects and programs in a risk-prioritized manner
• Experience integrating regulatory requirements, corporate policies, and industry standards into operating procedures and designs
• Experience maintaining and communicating security strategy and technical architecture
• Ability to translate operational metrics into meaningful KPIs and risk quantifiers
• Excellent written, verbal and interpersonal communications with non-technical leaders, customers, regulators, and technical colleagues
• Experience maintaining a fast-changing security program with continuous improvement driven by threat intelligence, adversary tactics, operational metrics, and company priorities
• Leadership experience managing a hybrid team of direct reports, matrix reports, managed services, and specialist contractors
• Bachelor's degree in computer science, information security, or a related field
• Recognized information security certification (CISSP, CISM, etc.)
• Prior experience with adoption of FAIR Threat modeling within the SDLC (preferred)
• Familiarity with DevSecOps processes, tooling, and controls (preferred)
• Experience gaining and maintaining certifications like ISO 270xx, SOC 2, etc. (preferred)
• Knowledge of regional security data privacy regulations related to minimization, encryption, and cross-border data access (preferred)

Core Competencies

Demonstrates extensive experience in managing and modernizing information security programs, with a focus on aligning security strategies with corporate policies and regulatory requirements. Capable of leading hybrid teams and translating operational metrics into meaningful KPIs while maintaining a fast-changing security environment.

Highest-signal resume keywords

• Information Security Management
• Risk Management
• Vulnerability Assessment
• Incident Response
• Security Strategy Development

ATS Optimization Keywords

Hard Skills

• Security Patterns
• Technical Security Controls
• Data Loss Prevention
• Malicious Activity Detection
• Adversarial Simulation
• KPI Development
• Threat Intelligence Integration
• Regulatory Compliance
• Cloud Security
• SaaS Security

Soft Skills

• Excellent Communication
• Leadership
• Interpersonal Skills
• Systematic Thinking
• Project Structuring

Certifications & Qualifications

• CISSP
• CISM
• ISO 270xx
• SOC 2

Industry Keywords

• Information Security
• Risk Management
• Data Privacy Regulations
• Threat Modeling
• Security Architecture

Tools & Technologies

• DevSecOps Processes
• Security Alerting Tools
• Incident Response Tools
• Vulnerability Management Tools
• Security Monitoring Systems