Senior Director, Identity, Cybersecurity Governance & Risk

Sunbelt Beverage Company, LLC; Linthicum (MD); On-site; USD 180,000 - 200,000; Full time

Job summary

Sunbelt Beverage Company, LLC is seeking a Senior Director Identity, Cybersecurity Governance & Risk to lead enterprise IAM, governance, and cyber risk management across the organization. This role partners with IT, Audit, Legal, Compliance, and business leadership to translate security risks into clear business terms.

You will define a multi-year IAM strategy, oversee IAM operations (IGA, SSO, MFA, PAM), establish policy controls, and drive metrics, governance forums, and executive dashboards

Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or related discipline.
• 10+ years of progressive experience in cybersecurity, information security, technology risk, and related disciplines.
• Significant leadership experience directing enterprise cybersecurity programs.
• Experience developing and executing enterprise cybersecurity strategies, platform implementations, and transformation programs.
• Strong knowledge of identity governance, authentication, privileged access, access lifecycle management.
• Two or more professional certifications such as CISSP, CISM, CISA, or CGEIT.

Responsibilities

• Define and execute a multi-year IAM strategy and governance framework.
• Oversee IAM capabilities including IGA, IVIP, SSO, MFA, PAM.
• Establish enterprise standards for authentication, authorization, least privilege, and access lifecycle.
• Drive automation of access administration and lifecycle management.
• Oversee IAM initiative performance, SLAs, onboarding, and remediation of access.
• Manage IAM technology vendors, implementation partners, and MSPs.
• Establish and maintain enterprise cybersecurity governance and risk management framework.
• Develop and maintain cybersecurity policies, standards, and control requirements.
• Partner with risk management and executive leadership to align cybersecurity risk with enterprise risk.
• Lead cybersecurity risk assessments across applications, infrastructure, cloud services, and major initiatives.
• Translate technical risk into business impact for Board reporting.
• Establish risk treatment, residual risk, and escalation processes.
• Develop cybersecurity KPIs, KRIs, dashboards, and performance reporting.

Skills

Leadership

Cybersecurity governance

Risk management

Executive communication

Identity governance

IAM

Education

Bachelor's degree in Cybersecurity / IT / CS / Risk Management

Job description

Time Type: Full time Remote Type: Job Family Group: Information Technology

Job Description Summary

The Senior Director Identity, Cybersecurity Governance & Risk is a senior cybersecurity leader responsible for enterprise Identity and Access Management (IAM), cybersecurity governance, cyber risk management, third-party risk management, compliance, and security performance measurement. This role owns strategy, implementation, operations, and continuous improvement of IAM capabilities while establishing the governance, policies, controls, risk processes, and metrics required to manage cybersecurity risk effectively across the enterprise. The position partners closely with the IT Vendor Management Function, Enterprise Architecture, Audit, Legal, Compliance, Human Resources, Operations, IT functions, and business leadership. The successful candidate will combine strategic leadership, security program management, technical credibility, operational discipline, and the ability to communicate cybersecurity risk in clear business terms.

Job Responsibilities

Identity and Access Management (IAM)

• Define and execute a multi-year IAM strategy, roadmap, architecture, operating model, and governance framework that aligns with business priorities, improved operational efficiencies, and technology transformation initiatives.
• Oversee implementation and ongoing operations of IAM capabilities including IGA, IVIP, SSO, MFA, PAM, access provisioning, recertification, and identity lifecycle management.
• Establish enterprise standards for authentication, authorization, least privilege, role-based access, privileged access, and joiner/mover/leaver processes.
• Drive automation and modernization of access administration to improve security, user experience, and operational efficiency.
• Oversee IAM imitative performance, service levels, application onboarding, policy exceptions, and remediation of excessive, dormant, orphaned, or inappropriate access.
• Manage IAM technology vendors, implementation partners, and managed service providers.

Cybersecurity Governance, Risk Management & Executive Reporting

• Establish and maintain the enterprise cybersecurity governance and risk management framework.
• Develop and maintain cybersecurity policies, standards, control requirements, exception processes, and accountability models.
• Partner with Enterprise Risk Management and executive leadership to align cybersecurity risk with enterprise risk appetite and tolerance.
• Maintain the cybersecurity risk register and ensure risks have clear owners, supported remediation plans, and appropriate executive visibility.
• Lead cybersecurity risk assessments across applications, infrastructure, cloud services, business processes, and major technology initiatives.
• Translate technical risk into business impact, including financial, operational, regulatory, reputational, and business partner considerations.
• Establish processes for risk treatment, residual risk assessment, formal risk acceptance, and escalation.
• Establish a cybersecurity measurement framework focused on risk reduction, control effectiveness, operational performance, and program maturity.
• Define KPIs, KRIs, service metrics, thresholds, and escalation criteria.
• Develop executive dashboards and Board reporting on cybersecurity risks, trends, program performance, and priorities.
• Use trend analysis and leading indicators to identify deteriorating performance or emerging risks.
• Benchmark cybersecurity maturity and performance against industry standards and peer organizations.

Third-Party Cybersecurity Risk Management

• Lead the cybersecurity component of the organization’s third-party risk management program.
• Establish risk-based due diligence and assessment requirements based on vendor criticality, platform tiering, data classifications, connectivity, and business impact.
• Oversee cybersecurity reviews during vendor selection, contracting, onboarding, periodic reassessment, renewal, and termination.
• Partner with IT Vendor Management and Legal to establish appropriate cybersecurity contractual requirements.
• Ensure significant vendor risks have documented remediation plans, compensating controls, or formally approved risk acceptance.
• Provide enhanced oversight of critical and high-risk vendors and report significant third-party risks to leadership.

Cybersecurity Compliance & Controls

• Establish and maintain a cybersecurity control framework supporting the organizational culture and strategic direction, that aligns with applicable standards and regulatory requirements, including frameworks such as NIST CSF, NIST 800-53, ISO 27001/27002, ISO 31000, ISO 27090, CMMC, CIS Controls, SOC 2, and PCI DSS where applicable.
• Translate cybersecurity standards and regulatory requirements into practical enterprise policies, controls, and evidence requirements.
• Oversee cybersecurity control assessments, maturity evaluations, audit support, and remediation activities.
• Partner with Audit, Compliance, Legal, and external assessors during audits, and security reviews.
• Monitor evolving cybersecurity standards and requirements and assess their impact on the organization.

Strategy, Leadership & Program Execution

• Develop multi-year strategies and annual operating plans across IAM, governance, risk, compliance, and third-party risk management functions.
• Translate cybersecurity strategy into prioritized programs, investments, roadmaps, and measurable outcomes.
• Build business cases for cybersecurity investments and communicate expected risk-reduction and business benefits.
• Serve as a trusted cybersecurity advisor to the CISO, CIO, executive leadership, and business stakeholders.
• Represent cybersecurity in major enterprise technology and business transformation initiatives.
• Other duties, as assigned by the jobholder’s supervisor, may also be required.

Minimum Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or related discipline, or equivalent professional experience.
• 10+ years of progressive experience in cybersecurity, information security, technology risk, and related disciplines.
• Significant leadership experience directing enterprise cybersecurity programs in a complex organization.
• Demonstrated experience developing and executing enterprise cybersecurity strategies, platform implementations, and transformation programs.
• Strong knowledge of identity governance, authentication, privileged access, access lifecycle management, and modern identity architectures.
• Demonstrated expertise in cybersecurity governance, risk management, third-party risk, compliance, and control frameworks.
• Experience with standards such as NIST CSF, NIST 800-53, ISO 27001/27002, CIS Controls, CMMC, SOC 2, or comparable frameworks.
• Experience supporting audits, compliance assessments, and executive risk reporting.
• Demonstrated ability to develop meaningful cybersecurity KPIs, KRIs, dashboards, and performance reporting.
• Strong executive communication and stakeholder-management skills.
• Experience managing cybersecurity budgets, vendors, consulting partners, and large-scale cross-functional initiatives.
• Two or more professional certifications such as CISSP, CISM, CISA, or CGEIT.
• Strong analytical and problem-solving skills, with the ability to diagnose and resolve complex issues across highly distributed environments.
• Excellent prioritization, organizational, and decision-making skills.
• Strategic thinking, conceptual problem-solving, and adaptability.

Physical Requirements

While performing the duties of this job, the employee is required to remain in a stationary position at times; communicate, and operate a computer and telephone. Competencies: People management responsibility for pay reviews, performance management, training, and resource planning. Requires conceptual thinking to understand complex issues and their implications, where sufficient information may not be available.

This job description is only a summary of the typical functions of this position, not an exhaustive or comprehensive list of all possible job responsibilities, tasks and duties. Responsibilities, tasks, and duties of individual jobholders may vary from the above description.

Compensation Range: $180, 000 to $200,000 Corporate Bonus: 30% - -

Breakthru Beverage Group is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, genetic information and other legally protected characteristics. The EEO is the Law poster is available here. If you need a reasonable accommodation because of a disability for any part of the employment process, please call [phone] and let us know the nature of your request and your contact information.

We’re driven to be the industry leader in every way, including how we treat our associates. Which is why we’ve built a people‑centric, relationship‑driven culture designed to maximize career advancement, a sense of belonging, and wellness. Focused on enhancing every aspect and phase of your career, the Breakthru experience includes our commitment to your growth, belonging, and wellness. Breakthru Beverage is a family‑owned and operated company with operations across the U.S. and Canada, and more than $8 billion in annual sales driven by a team of 10,000 associates. We deliver world‑renowned brands to the doorsteps of North America’s retail, bar and restaurant businesses.