Senior Director, Cybersecurity and Technology Risk

TransMedics; Andover (MA); On-site; USD 250,000 - 350,000; Full time

Job summary

TransMedics, Inc. is seeking a Senior Director, Cybersecurity and Technology Risk to own the enterprise cybersecurity program, security engineering and technology risk across global operations.

You will lead a high‑performing team and partner with Legal, Regulatory, and Physical Security to embed secure‑by‑design practices. This role defines and executes a multi‑year strategy, builds security‑as‑code and policy‑as‑code capabilities, and drives education to raise risk awareness across the

Qualifications

• Bachelor's degree in cybersecurity, IT, CS, engineering or related field.
• 15+ years of progressive cybersecurity/tech risk leadership experience.
• Ownership of an enterprise cybersecurity program in a global, regulated environment.
• Deep expertise in security architecture and engineering (cloud, apps, infra, DevSecOps).
• Leadership in IAM, PAM, data security, DLP, vulnerability management, monitoring, and incident response.
• Strong knowledge of technology risk management, control design and risk reporting.
• Practical experience applying the NIST framework.

Responsibilities

• Define and execute multi-year cybersecurity strategy and operating model.
• Own security architecture across cloud, infrastructure, applications, data and platforms.
• Build security as code and policy as code with automated guardrails and continuous control validation.
• Own identity and access management and privileged access management.
• Lead data security and data loss prevention capabilities.
• Establish incident response, threat management, vulnerability management and security monitoring.
• Build an enterprise security education and awareness program.

Skills

Leadership

Cybersecurity strategy

Security architecture

Cloud security

IAM

Data security

Incident response

Education

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related field

Job description

Job Description:

POSITION SUMMARY

As a key leader on the Digital and IT leadership team, the Senior Director, Cybersecurity and Technology Risk will own the enterprise cybersecurity program, technology risk function and security engineering. This leader will establish a modern, risk-based security capability for the enterprise with the following mandates:

• Own and continuously mature the enterprise cybersecurity program, security engineering and solutions, and technology risk framework to support our growth and safety of our critical global operations
• Build security-as-code and policy-as-code capabilities that embed automated guardrails, continuous compliance and secure‑by‑design practices across infrastructure, cloud, data and application environments.
• Work across business functions to ensure appropriate and meaningful education, understanding and awareness is achieved for our employees when it comes to cybersecurity and technology risk

As a visible enterprise leader, you will build trusted relationships across Legal, Regulatory, Physical Security other business functions. You will be both a player and a coach, setting clear direction while building a high‑performing team and a strong security culture.

RESPONSIBILITIES

This position is responsible for, but not limited to, the following:

Cybersecurity Program, Engineering and Operations

• Define and execute a multi‑year cybersecurity strategy, operating model and investment roadmap aligned with enterprise priorities, patient safety and the company's global risk profile
• Own security architecture and engineering across cloud, infrastructure, applications, data and digital platforms, establishing secure‑by‑design patterns and reusable controls. You will partner tightly with your peers to align on the outcomes and approach.
• Build and maintain security as code and policy as code through automated guardrails, continuous control validation, compliance evidence, threat detection and remediation workflows
• Own enterprise identity and access management and privileged access management, including identity governance, authentication, authorization, access certification and privileged account controls
• Lead data security and data loss prevention capabilities, including data classification, encryption, key management, monitoring and controls for sensitive information
• Establish and continually improve incident response, threat management, vulnerability management, security monitoring, crisis coordination and post‑incident learning
• Build an enterprise security education and awareness program that strengthens role‑based accountability, secure behaviors and readiness across the workforce

Technology Risk, Compliance and Enterprise Partnerings

• Own the technology risk management program, including risk identification, assessment, treatment, exception management, control testing, metrics and executive reporting
• Establish and maintain a cybersecurity control framework informed by NIST and other relevant industry standards, with clear control ownership and evidence‑based assurance
• Partner closely with the Chief Legal Officer and Chief Regulatory Officer to interpret and operationalize cybersecurity, privacy and reporting obligations, including GDPR, HIPAA, CMS requirements and applicable FAA regulations
• Partner with the VP of Physical Security to develop an integrated cyber and physical security operating model, coordinated incident response and converged protection capabilities for employees, facilities and critical operations

MANAGEMENT RESPONSIBILITIES

• Build and maintain a high performing team responsible to execute the scope of responsibility
• Manage and maintain partner relationships across technology and service providers that support your function. Hold our partners accountable in getting the most value from our relationships
• Develop organizational capabilities, succession plans and targeted talent development strategies to maintain a high performing team

PHYSICAL ATTRIBUTES

None identified

MINIMUM QUALIFICATIONS

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related field
• 15+ years of progressive experience in cybersecurity, security engineering, technology risk or enterprise technology, including significant leadership responsibility
• Demonstrated ownership of an enterprise cybersecurity program in a complex, highly regulated and globally operating environment
• Deep and hands on experience in security architecture and engineering, including cloud security, application security, infrastructure security, DevSecOps, security as code and policy as code
• Proven experience leading identity and access management, privileged access management, data security, data loss prevention, vulnerability management, security monitoring and incident response capabilities
• Strong command of technology risk management, control design, assurance, regulatory examinations and executive-level risk reporting
• Practical experience applying the NIST C