Senior Director Information Security

EverCommerce; Denver (CO); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Wellness stipend

Udemy training

401k with company match

Paid time off

Employee Stock Purchase Program

Job summary

EverCommerce is seeking a Senior Director Information Security to lead a scalable, business-aligned security program across a diverse SaaS portfolio. You will balance strategic planning with hands-on execution, reporting to the CISO.

The role partners with Legal, Compliance, People, and product teams; you will drive platform security as code, shift-left appsec, incident response, and risk governance while fostering an engineering mindset.

Qualifications

• Proven track record building or modernizing SIEM/SOAR pipelines, automated detection engineering, and incident response operations.
• Hands-on engineering background in AWS cloud infrastructure, Infrastructure-as-Code (Terraform/CloudFormation), and container orchestration (ECS, EKS, Docker).
• 6+ years of direct people leadership in high-growth, multi-disciplinary teams.
• 12+ years of progressive leadership across cloud security, software platform security, security strategy, architecture, engineering, controls, testing, vulnerability management, incident response, and cyber resiliency.
• Experience designing and executing continuous compliance programs under SOX 404(b), HIPAA, PCI DSS, or SEC reporting frameworks.
• Ability to translate complex security risks into clear business metrics for executives and boards.

Responsibilities

• Proven track record building or modernizing SIEM/SOAR pipelines, automated detection engineering, and incident response operations.
• Lead enterprise incident response, digital forensics, RCA, and executive crisis communications.
• Direct internal and contingent red-team penetration testing across HIPAA, PCI, and SaaS platforms, driving cross-team CTF exercises and threat modeling.
• Transition GRC to API-driven, continuous control validation supporting SOX 404(b), HIPAA, PCI DSS, NIST CSF, EHNAC, and SEC disclosures.
• Modernize the SOC, optimizing SIEM telemetry and SOAR automation.
• Foster engineering mindset via internal security guilds to upskill teams in secure coding and cloud operations.
• Develop multi-year cybersecurity strategies and roadmaps; align investments with business priorities.
• Support mergers, acquisitions, and divestitures from a cybersecurity perspective; drive AI/automation across security ops.

Skills

Security leadership

SIEM & SOAR

AWS cloud

IaC (Terraform)

Container orchestration

GRC programs

M&A security

Threat intelligence

Risk management

Security architecture

Education

Bachelor’s or Master’s in CS/Cybersecurity/Engineering

Tools

Elastic Cloud

Torq SOAR

CrowdStrike

Okta

AWS Secrets Manager

PAM

TruffleHog

Job description

• This role reports to the Chief Information Security Officer (CISO) and requires a hands-on cybersecurity leader who can balance strategic planning with operational execution, and is responsible for maturing a scalable, business-aligned security program supporting a diverse portfolio of dozens of SaaS products across multiple vertical business units
• The Senior Director Information Security partners closely with the multiple groups including Vertical Business Product Development, Legal, Compliance, the People Team, and senior leadership to ensure security enables innovation while effectively managing cyber risk
• Platform Security-as-Code: Partner with Platform Engineering to enforce mandatory security baselines, Terraform modules, and AWS Control Tower account isolation
• Shift-Left AppSec & Container Security: Embed automated security gates (SAST, DAST, SCA, dependency analysis, and TruffleHog secret scanning) directly into GitHub CI/CD pipelines
• Golden Container & AMI Approval: Establish signing, scanning, and approval pipelines for the Central Golden Container Registry to eliminate base-image vulnerability drift across production
• Central Secrets & Cryptographic Lifecycle: Mandate enterprise-wide AWS Secrets Manager and Vault architectures, enforcing automated 60/90-day rotation and eliminating plain-text secrets across staging and production
• 24x7 Detection & Threat Hunting: Direct the modernization of the Security Operations Center (SOC), optimizing SIEM telemetry (Elastic Cloud / ECS log schemas) and SOAR automation (Torque)
• Zero-Code Infrastructure Observability: Leverage Linux kernel-level telemetry (eBPF and OpenTelemetry collectors) baked into base infrastructure to catch unauthorized API access, anomalous database queries, and lateral movement out-of-process
• Crisis Management & Incident Response: Lead enterprise incident response, digital forensics, root cause analysis (RCA), and executive crisis communications
• Adversary Emulation & Offensive Security (Red/Purple Teaming): Direct internal and contingent red-team penetration testing across all HIPAA, PCI, and proprietary SaaS platforms, driving cross-team CTF exercises and threat modeling
• Continuous Compliance Automation: Transition GRC from point-in-time manual evidence collection to API-driven, continuous control validation supporting SOX 404(b), HIPAA, PCI DSS, NIST CSF, EHNAC, and SEC disclosure requirements
• Centralized Risk Governance: Maintain an auditable, real-time enterprise Risk Register, eliminating fragmented policy exceptions in email and chat tools
• Third-Party Risk & Customer Trust: Standardize vendor risk management workflows (Coupa/security assessments) and provide automated security assurance documentation for enterprise customer deals
• Embedded Security Spokes: Deploy and lead dedicated Security Engineering “Spokes” who sit directly in Vertical Business Units product sprint planning to eliminate delivery roadblocks upfront
• Security & Cloud Guilds: Foster an engineering mindset across the broader technology team, establishing internal training guilds to upskill engineers in secure coding, automation, and modern cloud operations
• Develop multi-year cybersecurity strategic plans and roadmaps
• Align security investments with business priorities
• Support mergers, acquisitions, and divestitures from a cybersecurity perspective
• Drive AI and automation across security operations
• Inspire high-performing security teams
• Develop future security leaders
• Build trusted relationships with multiple levels of leadership and business stakeholders
• Communicate complex cybersecurity risks in business terms
• Foster collaboration across decentralized business units
• Promote a culture of accountability, innovation, and operational excellence
• Lead through influence in a matrixed organizational environment

Benefits

• Flexibility to work where/how you want – in-office, remote, or hybrid
• Robust health and wellness benefits, including an annual wellness stipend
• Continued investment in your professional development through Udemy
• 401k with company match
• Flexible and generous paid time off
• Employee Stock Purchase Program

The ideal candidate is an experienced security leader capable of balancing strategic planning with operational execution in a fast-paced, acquisition-driven SaaS organizationEducation: Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline (or equivalent practical experience)Proven track record building or modernizing SIEM/SOAR pipelines, automated detection engineering, and incident response operationsDemonstrated hands-on engineering background in AWS cloud infrastructure, Infrastructure-as-Code (Terraform/CloudFormation), and container orchestration (ECS, EKS, Docker)6+ years of direct people leadership experience leading multi-disciplinary teams (Architecture, SecOps, IR, GRC) in high-growth, public SaaS or enterprise technology companies12+ years of progressive leadership with significant focus across multiple information security domains, including cloud security, and software platform security, security strategy, architecture, engineering, controls, testing, vulnerability management, incident response, and cyber resiliencyDirect experience designing and executing continuous compliance programs under SOX 404(b), HIPAA, PCI DSS, or SEC reporting frameworksExceptional ability to translate complex security risks into clear business metrics (MTTD, MTTR, exposure burn-down) for C-suite executives and Board Audit CommitteesStrong collaborative acumen to lead through influence in a decentralized, multi-business unit operating modelStrong knowledge of or leading enterprise security architecture, building and maturing security GRC programs, and deep knowledge of cyber threat landscapes, attacker tactics, techniques, and procedures (TTPs)Experience leading security due diligence and post-merger integration for high-volume M&A activityRecognized security and architecture credentials (e.g., CISSP, CISM, CISA, GMON, CCSP, AWS Certified Security Specialty)Direct experience with modern security tools: Information Asset Inventory systems, SIEM tools, Elastic Cloud, Torq SOAR, CrowdStrike, EDR/MDR/XDR, Okta, Netskope, AWS Secrets Manager, PAM, TruffleHog, and Lumos AIExperience working with SaaS software development and product teamsExperience working with distributed and remote team environments