Senior InfoSec Leader — Hands-on, GRC & Risk

Old Republic Commercial Risk; Philadelphia (Philadelphia County); On-site; USD 180,000 - 280,000; Full time

Job summary

Old Republic Commercial Risk seeks a Director of Information Security to design, implement, and operate a comprehensive program across three affiliated companies. This hands‑on leader combines technical security leadership, risk management, and GRC oversight, advising executives and clients on risks in business terms.

You will lead a small security team and drive controls across identity, endpoint, network, cloud, and SaaS environments while guiding incident response and risk remediation.

Qualifications

• 8+ years of progressive information security experience, including leadership roles.
• Proven ability to mentor small security teams.
• Hands-on expertise with Okta, Zscaler, Azure, Microsoft 365.
• Experience in governance, risk, and compliance, including ITGCs and audits.
• Experience in regulated environments, preferably financial services or insurance.
• Certifications such as CISSP, CISM, CRISC, or CGEIT are a plus.

Responsibilities

• Lead and mentor a small security team, providing direction and hands-on support.
• Design, implement, and maintain security controls across identity, endpoint, network, cloud, and SaaS.
• Provide technical oversight for security incidents, investigations, and response activities.
• Ensure consistent security posture across three companies while balancing business needs.
• Lead security risk assessments to identify, analyze, prioritize, and document risks.
• Communicate risk exposure and mitigation strategies to non-technical stakeholders.
• Drive remediation efforts and integrate security risk management with enterprise risk processes.
• Own IT general controls (ITGCs) and support audits and regulatory requirements.

Skills

Security leadership

Governance & risk

Incident response

Executive communication

Education

Bachelor's degree in Information Security, CS, or related field

Tools

Okta

Zscaler

Azure

Microsoft 365

Proofpoint

CrowdStrike

Splunk

Job description

Old Republic Commercial Risk seeks a Director of Information Security to design, implement, and operate a comprehensive program across three affiliated companies. This hands‑on leader combines technical security leadership, risk management, and GRC oversight, advising executives and clients on risks in business terms.

You will lead a small security team and drive controls across identity, endpoint, network, cloud, and SaaS environments while guiding incident response and risk remediation.