Director of Security, Risk, & Compliance

Director of Security, Risk, & Compliance

Cross is seeking a Director- or VP-level leader, based on experience and qualifications, to oversee our Security, Risk, and Compliance function. This role offers a potential career path to Chief Information Security Officer (CISO).

Job Summary and Objectives:

The Director of Security, Risk, & Compliance is responsible for developing, implementing, and maintaining the organization's cybersecurity risk management, regulatory compliance, and privacy. This role will integrate compliance, privacy, and cybersecurity under a unified governance strategy for an Internet Service Provider (ISP), Managed Service Provider (MSP), cloud services provider, and data center operator.

The role will partner with IT, Network Operations, Sales, HR, and Finance to build a culture of compliance and risk awareness.

Essential Job Functions:

Cybersecurity Compliance & Resilience

• Oversee compliance with cybersecurity frameworks, including NIST Cybersecurity Framework (CSF), CIS Controls, SOC 2, and CMMC.
• Coordinate security audits, penetration testing, vulnerability assessments, and compliance reviews.
• Facilitate tabletop exercises and resilience testing.
• Support incident management and post-incident reviews.
• Monitor security-related regulatory changes and industry requirements.

ISP Regulatory Compliance

• Ensure compliance with applicable telecommunications regulations and reporting obligations.
• Support requirements related to FCC regulations and USF and broadband funding programs and serve as the company’s CPNI officer.
• Monitor regulatory changes and industry requirements.

MSP & Client Compliance

• Support customer compliance requirements in regulated industries including healthcare (HIPAA) and financial services.
• Assist sales and operations teams with security questionnaires, RFPs, and customer audits.

Data Privacy & Governance

• Manage data privacy programs and related policies.
• Oversee data classification, retention, and governance standards to ensure proper handling of confidential, customer, and employee information.

Audits & Internal Controls

• Coordinate external regulatory and information security audits and assessments.
• Track audit findings and corrective actions.
• Facilitate risk assessments and internal audits of regulatory compliance, information security, and privacy practices.

Risk Management

• Identify, assess, monitor, and report cybersecurity, regulatory, and privacy risks.
• Lead third-party and vendor risk management programs.

Compliance Policies & Training

• Develop and maintain corporate compliance policies and standards.
• Lead compliance training and security awareness initiatives.

Customer Service

• Providing excellent customer service by following the company’s customer service standards. Ownership, Professionalism, Troubleshooting, keeping customers informed, and providing customers with an experience beyond their expectations

Supervisor Responsibilities: This role provides direct supervision to a team of employees, including responsibilities for hiring, performance management, and disciplinary actions. The supervisor will be responsible for training new hires, mentoring team members, and ensuring the team's adherence to company policies and procedures. The supervisor will also be responsible for assigning tasks, setting team goals, and evaluating performance. This position requires strong leadership and communication skills to manage and support the team's success effectively.

Competencies:

• Strong knowledge of cybersecurity and risk management frameworks.
• Experience leading audits and regulatory compliance programs.
• Excellent communication and executive presentation skills.

Preferred

• Experience working for a broadband, telecommunications, MSP, or cloud services provider.
• Familiarity with FCC regulatory requirements.
• Experience supporting SOC 2, HIPAA, NIST CSF, or CMMC programs.
• Understanding of network operations and cybersecurity controls.
• Experience managing enterprise risk programs.

Physical and Mental Requirements:

Physical Requirements

• Prolonged sitting and computer use.
• Frequent typing, reading, and use of standard office technology.
• Occasional standing, walking, bending, and reaching.
• Ability to lift and carry up to 20 pounds occasionally.
• Ability to travel to company facilities, customer locations, and industry events as needed.
• Ability to communicate effectively in person, by phone, and via virtual platforms.

Mental Requirements

• Strong analytical, problem-solving, and decision-making skills.
• Ability to interpret complex regulatory, cybersecurity, and compliance requirements.
• Ability to manage multiple projects, priorities, and deadlines.
• Strong attention to detail and organizational skills.
• Ability to maintain confidentiality and exercise sound judgment.
• Effective communication, leadership, and stakeholder management skills.
• Ability to perform effectively under pressure during audits, incidents, and regulatory reviews.

Certification/License Requirements:

• Valid Driver’s License

Preferred Certifications

• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• Certified Compliance & Ethics Professional (CCEP)

Work Environment:

• Primarily an indoor, climate-controlled office environment.
• Regular use of computers, monitors, telephones, and other office equipment.
• Occasional work within data centers, network facilities, and customer locations.
• Exposure to moderate noise levels from telecommunications and data center equipment during site visits.
• Occasional local and overnight travel may be required.
• May be required to respond outside normal business hours during security incidents, audits, or business continuity events.

Education:

• Bachelor’s degree in Information Security, Cybersecurity, Risk Management, Business, Information Systems, or related field.
• 7+ years of experience in governance, risk management, compliance, cybersecurity, auditing, or related disciplines.
• 3+ years in a management role.