Senior Director, Cybersecurity and Technology Risk

TransMedics, Inc.; Andover (MA); On-site; USD 200,000 - 300,000; Full time

Benefits offered by this job

Medical with HRA

Dental

Vision

Healthcare FSA

Dependent Care FSA

Short Term Disability

Long Term Disability

401K Plan

Pet insurance

Employee Stock Purchase Plan

Job summary

TransMedics, Inc. is seeking a Senior Director of Cybersecurity and Technology Risk to lead the enterprise security program, risk framework and engineering across cloud, data and applications.

You will champion secure-by-design practices, develop automated guardrails, and drive education across the organization while partnering with Legal, Regulatory and Physical Security to ensure regulatory compliance and incident readiness.

Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering or related field.
• 15+ years of progressive experience in cybersecurity, security engineering, technology risk or enterprise technology with leadership.
• Deep hands-on experience in security architecture across cloud, apps and infra, including DevSecOps and secure-by-design patterns.
• Proven leadership in IAM, PAM, data security and incident response with executive reporting.
• Strong knowledge of NIST CSF, regulatory obligations (GDPR, HIPAA, CMS, FAA) and risk management.

Responsibilities

• Define and execute multi-year cybersecurity strategy, operating model and investment roadmap.
• Own security architecture across cloud, infrastructure, apps, data and digital platforms.
• Build security-as-code and policy-as-code guardrails with automated compliance evidence.
• Lead data security, DLP, IAM/PAM programs and incident response capabilities.
• Partner with Legal, Regulatory, Privacy, Quality and Physical Security on obligations and audits.
• Develop enterprise education to raise security awareness and accountability.

Skills

Cybersecurity strategy

Security engineering

Cloud security

DevSecOps

Risk management

NIST CSF

Regulatory compliance

Leadership

Communication

Crisis management

Education

Bachelor's degree in Cybersecurity/IT/CS/Engineering

Tools

IAM

PAM

DLP

Threat detection

Job description

Job Description:POSITION SUMMARYAs a key leader on the Digital and IT leadership team, the Senior Director, Cybersecurity and Technology Risk will own the enterprise cybersecurity program, technology risk function and security engineering. This leader will establish a modern, risk-based security capability for the enterprise with the following mandates:Own and continuously mature the enterprise cybersecurity program, security engineering and solutions, and technology risk framework to support our growth and safety of our critical global operationsBuild security-as-code and policy-as-code capabilities that embed automated guardrails, continuous compliance and secure-by-design practices across infrastructure, cloud, data and application environments.Work across business functions to ensure appropriate and meaningful education, understanding and awareness is achieved for our employees when it comes to cybersecurity and technology riskAs a visible enterprise leader, you will build trusted relationships across Legal, Regulatory, Physical Security other business functions. You will be both a player and a coach, setting clear direction while building a high-performing team and a strong security culture.RESPONSIBILITIESThis position is responsible for, but not limited to, the following:Cybersecurity Program, Engineering and OperationsDefine and execute a multi-year cybersecurity strategy, operating model and investment roadmap aligned with enterprise priorities, patient safety and the company’s global risk profileOwn security architecture and engineering across cloud, infrastructure, applications, data and digital platforms, establishing secure-by-design patterns and reusable controls. You will partner tightly with your peers to align on the outcomes and approach.Build and maintain security as code and policy as code through automated guardrails, continuous control validation, compliance evidence, threat detection and remediation workflowsOwn enterprise identity and access management and privileged access management, including identity governance, authentication, authorization, access certification and privileged account controlsLead data security and data loss prevention capabilities, including data classification, encryption, key management, monitoring and controls for sensitive informationEstablish and continually improve incident response, threat management, vulnerability management, security monitoring, crisis coordination and post-incident learningBuild an enterprise security education and awareness program that strengthens role-based accountability, secure behaviors and readiness across the workforceTechnology Risk, Compliance and Enterprise PartnershipOwn the technology risk management program, including risk identification, assessment, treatment, exception management, control testing, metrics and executive reportingEstablish and maintain a cybersecurity control framework informed by NIST and other relevant industry standards, with clear control ownership and evidence-based assurancePartner closely with the Chief Legal Officer and Chief Regulatory Officer to interpret and operationalize cybersecurity, privacy and reporting obligations, including GDPR, HIPAA, CMS requirements and applicable FAA regulationsPartner with the VP of Physical Security to develop an integrated cyber and physical security operating model, coordinated incident response and converged protection capabilities for employees, facilities and critical operationsMANAGEMENT RESPONSIBILITIESBuild and maintain a high performing team responsible to execute the scope of responsibilityManage and maintain partner relationships across technology and service providers that support your function. Hold our partners accountable in getting the most value from our relationshipsDevelop organizational capabilities, succession plans and targeted talent development strategies to maintain a high performing teamPHYSICAL ATTRIBUTESNone identifiedMINIMUM QUALIFICATIONSBachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related field15+ years of progressive experience in cybersecurity, security engineering, technology risk or enterprise technology, including significant leadership responsibilityDemonstrated ownership of an enterprise cybersecurity program in a complex, highly regulated and globally operating environmentDeep and hands on experience in security architecture and engineering, including cloud security, application security, infrastructure security, DevSecOps, security as code and policy as codeProven experience leading identity and access management, privileged access management, data security, data loss prevention, vulnerability management, security monitoring and incident response capabilitiesStrong command of technology risk management, control design, assurance, regulatory examinations and executive-level risk reportingPractical experience applying the NIST Cybersecurity Framework and related security and risk frameworks to enterprise programsExperience translating GDPR, HIPAA, CMS and applicable FAA cybersecurity obligations into sustainable controls, operating procedures and evidenceTrack record of partnering effectively with Legal, Regulatory, Privacy, Quality, Physical Security, Digital and business leadersExcellent communication, leadership, talent development, crisis management and organizational change skillsPREFERRED QUALIFICATIONSExperience within highly regulated industries such as MedTech, Healthcare, Life Sciences, Aviation or ManufacturingAdvanced knowledge of NIST CSF, NIST 800-series guidance, ISO 27001, CIS Controls or comparable security and risk frameworksExperience designing integrated cyber and physical security operating models and leading cross-functional crisis responseRelevant professional certifications such as CISSP, CISM, CRISC, CCSP or equivalentTransMedics, Inc. is a commercial-stage medical technology company transforming organ transplant therapy for patients worldwide. Our mission is to help save more patients’ lives by increasing access to viable donor organs for those who are awaiting an organ transplant. To accomplish this mission, we partner closely with transplant stakeholders worldwide and help expand their access to healthy donor organs, while delivering the highest quality technology, service, clinical care and outcomes.Driven by a passion for improving patient care, we make the impossible possible and keep our employees at the center of everything we do. Together, we strive to enhance the quality of life for transplant recipients and their families, fostering hope and healing in the journey toward better health.Maximize your potential at TransMedics, Inc.www.TransMedics.comEmployee Benefit:Medical with Health Reimbursement Account through Blue Cross/Blue Shield of MADentalVisionHealthcare Flexible Spending AccountDependent Care Flexible Spending AccountShort Term DisabilityLong Term Disability401K PlanPet insuranceEmployee Stock Purchase PlanTransMedics is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, marital status, age, disability or protected veteran status, or any other characteristic protected by law. We are committed to creating an inclusive environment for all employees.