Cyncly

Compensation

Full Description

Job Title: Director - Security  Location: USA / EST time zone Contract: Permanent About us: Cyncly is a global technology powerhouse with 2,800+ employees and 70,000+ customers across 100+ countries and 46+ offices. Cyncly transforms the way customizable products and spaces are imagined, designed, sold, managed and made. Our end-to-end software solutions connect professional designers, retailers and manufacturers to the world's largest repository of product content. Today, our business spans across the Kitchen & Bath, Furniture, Window, Glass & Door, and Flooring industries with operations in North & South America, Europe, Asia Pacific and Africa. Cyncly offers over 30 years of experience to deliver more value for our customers through an expanded portfolio of end-to-end solutions. Our global presence allows us to provide world-class support and sales with a local touch, providing the best possible customer experience. Cyncly is now embarking on an exciting journey as we continue to expand through strong organic growth and complementary acquisitions, backed by leading growth private equity firms specializing in technology. About the Role The Director –  Security is a senior IT leadership role responsible for defining, executing, and continuously maturing Cyncly's global cyber security strategy, data protection Programme, and information security posture. Reporting to the Head of IT & Cyber Security, this role serves as the primary owner of all security disciplines across the organization — from threat detection and incident response to security architecture, data governance, and regulatory compliance. A critical element of this role is owning Cyncly's compliance obligations end-to-end, including achieving and maintaining SOC 2 Type II certification across Cyncly's global operations, as well as ensuring adherence to GDPR, ISO 27001, and other applicable regulatory and industry frameworks. The Director will act as Cyncly's senior authority on all matters relating to information security risk, data privacy, and cyber resilience, partnering closely with Product, Engineering, Legal, and business leadership to embed security into the fabric of everything Cyncly does. Key Responsibilities Cyber Security Strategy & Leadership * Define and own Cyncly's global cyber security strategy, roadmap, and operating model, aligning security investment and priorities to business risk and growth objectives. * Build and lead a high-performing, globally distributed cyber security and information security team, setting clear direction, developing talent, and fostering a culture of security awareness and accountability. * Act as the primary security advisor to the Head of IT & Cyber Security, CTO, and senior leadership, translating complex threats and technical risks into clear, business-relevant guidance. * Represent Cyncly's security posture to customers, prospects, auditors, regulators, and the Board as required, including participation in enterprise risk and audit committee reporting. * Establish and govern security policies, standards, and procedures organisation-wide, ensuring they are understood, implemented, and maintained across all business units and geographies. * Drive a continuous improvement culture within the security function, leveraging threat intelligence, industry benchmarking, and emerging best practices to evolve Cyncly's defences. Compliance, Certifications & Regulatory Obligations * Own end-to-end accountability for Cyncly's SOC 2 Type II certification programme — including scoping, control design, evidence collection, auditor management, and remediation of findings — ensuring successful annual certification and ongoing continuous compliance. * Lead and maintain compliance with ISO 27001, GDPR, CCPA, and other applicable data protection and privacy regulations across all jurisdictions in which Cyncly operates. * Serve as the primary point of contact for external security auditors, regulatory bodies, and certification authorities, managing all audit engagements from planning through to report issuance. * Develop and maintain a compliance calendar and evidence management framework, ensuring Cyncly is audit-ready at all times with minimal operational disruption. * Monitor the evolving global regulatory landscape and proactively identify and address new compliance obligations arising from changes in law, customer contractual requirements, or market expectations. * Collaborate with Legal, Finance, and HR to ensure organisation-wide policies (data retention, privacy notices, HR security controls, supplier assurance) meet compliance obligations. Data & Information Security * Define and implement Cyncly's data classification framework, data governance policies, and information lifecycle management practices, ensuring sensitive data is identified, protected, and handled appropriately throughout its lifecycle. * Oversee the design and implementation of data loss prevention (DLP) controls, encryption standards, and data access management programmes across all data repositories, cloud platforms, and SaaS applications. * Embed data privacy by design principles into all product development, infrastructure, and business processes, in partnership with Engineering and Product leadership. * Manage the end-to-end response to data subject access requests (DSARs), data breach notifications, and privacy incidents, ensuring timely and compliant responses in accordance with GDPR and local privacy laws. * Partner with Enterprise Architecture and Engineering to ensure data flows, storage locations, and processing activities are documented, controlled, and compliant with applicable regulations and customer contractual obligations. Threat Detection, Incident Response & Security Operations * Own and mature Cyncly's Security Operations Centre (SOC) capability — whether in-house or managed — ensuring 24/7 detection, triage, and response coverage across endpoints, cloud, network, and application layers. * Develop, maintain, and test Cyncly's Incident Response (IR) plan and cyber crisis management playbooks, including tabletop exercises, breach simulations, and executive-level crisis communication procedures. * Act as the senior Incident Commander for significant cyber security incidents, providing decisive leadership through containment, eradication, recovery, and post-incident review. * Drive the adoption of threat intelligence platforms, SIEM/SOAR tooling, EDR/XDR solutions, and vulnerability management programmes to improve Cyncly's detection and response capabilities. * Reduce mean time to detect (MTTD) and mean time to respond (MTTR) through automation, playbook-driven response, and continuous tuning of detection logic. * Lead the organisation's vulnerability management and penetration testing programmes, ensuring findings are tracked, prioritised by risk, and remediated within agreed SLAs. Security Architecture & Engineering * Define and govern Cyncly's security architecture principles and standards across cloud (Azure/AWS), on-premises, hybrid, and SaaS environments, ensuring security is embedded by design in all technology programmes. * Lead the design and implementation of zero-trust network architecture, identity-centric security controls, and micro-segmentation strategies across Cyncly's global environment. * Oversee the evaluation and selection of security tooling and platforms, ensuring Cyncly's security stack is fit-for-purpose, integrated, and cost-effective. * Partner with the Infrastructure, Cloud, and DevOps teams to embed security into the CI/CD pipeline, IaC templates, and cloud landing zones (DevSecOps). * Provide security architecture review and sign-off for major technology programmes, M&A integrations, new product launches, and significant platform changes. Identity, Access & Privileged Access Management * Own and mature Cyncly's Identity and Access Management (IAM) programme, including role-based access control (RBAC), least-privilege enforcement, and access certification processes across all systems and applications. * Lead the design and implementation of Privileged Access Management (PAM) controls, ensuring all privileged accounts and administrative access are governed, monitored, and auditable. * Drive the adoption of Single Sign-On (SSO), Multi-Factor Authentication (MFA), and Conditional Access policies across all Cyncly platforms and third-party applications. * Collaborate with HR and IT Operations to ensure joiners, movers, and leavers processes include timely and accurate provisioning and deprovisioning of access rights. Mergers & Acquisitions — Security Due Diligence & Integration * Lead cyber security due diligence assessments for M&A targets, evaluating their security posture, data protection practices, compliance status, and technical debt, providing risk-rated findings to inform deal decisions. * Define and execute security integration roadmaps for acquired businesses, onboarding them into Cyncly's security standards, tooling, and compliance frameworks within agreed timelines. * Build and maintain repeatable M&A security assessment and integration playbooks to accelerate and de-risk future acquisitions. * Ensure acquired entities meet SOC 2 and other applicable compliance obligations as part of the post-acquisition integration programme. Security Awareness, Culture & Third-Party Risk * Design and deliver a comprehensive security awareness and training programme for all Cyncly employees globally, including phishing simulations, role-specific training, and executive security briefings. * Manage Cyncly's third-party and supplier security risk programme, ensuring all critical vendors and partners are assessed for security risk and held to Cyncly's minimum security standards via contractual and audit mechanisms. * Build and maintain a security champion network across Engineering and Product teams, fostering a security-first culture at the development and operational level. Qualifications and Skills Required Qualifications * Bachelor's degree or equivalent in Computer Science, Information Security, Cybersecurity, or a related field; advanced degree preferred. * 20+ years of progressive experience in information security, cyber security, and data protection, with a minimum of 10+ years in a senior security leadership or director-level role. * Proven, hands-on experience achieving and maintaining SOC 2 Type II certification in a complex, multi-product, global software or SaaS organisation. * Deep expertise in GDPR, CCPA, and global data privacy regulations, with direct experience managing regulatory engagements and data subject rights obligations. * Demonstrated experience building and maturing security functions from the ground up or transforming existing security organisations within PE-backed or high-growth environments. * Track record of leading complex, organisation-wide security programmes including cloud security transformations, zero-trust implementations, and M&A security integrations. * Experience operating across globally distributed organisations across multiple time zones and jurisdictions. Mandatory Technical & Domain Expertise * Cloud Security: Deep expertise in securing Microsoft Azure environments (including Azure Security Centre, Defender for Cloud, Sentinel); experience with AWS or GCP security is advantageous. * Compliance Frameworks: Expert-level knowledge of SOC 2 (Trust Services Criteria), ISO 27001/27002, NIST CSF, CIS Controls, and GDPR/CCPA; experience with PCI DSS or HIPAA is a plus. * Security Operations: Strong understanding of SIEM (e.g. Microsoft Sentinel, Splunk), SOAR, EDR/XDR platforms, and vulnerability management tools (e.g. Qualys, Tenable, Rapid7). * Data Protection: Expertise in DLP technologies, data classification, encryption (at rest and in transit), and data governance tooling. * Identity Security: Deep knowledge of Active Directory, Azure AD/Entra ID, PAM solutions (e.g. CyberArk, BeyondTrust), SSO, MFA, and Conditional Access. * Application & DevSecOps Security: Experience embedding security into DevOps pipelines (SAST, DAST, SCA), IaC security scanning, and container/Kubernetes security. * Network Security: Knowledge of enterprise network security, zero-trust networking, SD-WAN security, firewall management (Palo Alto, Cisco), and microsegmentation. Professional Certifications (Required or Preferred) * Required: CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager). * Strongly preferred: CCSP (Certified Cloud Security Professional), CRISC (Certified in Risk and Information Systems Control), or equivalent. * Preferred: ISO 27001 Lead Implementer or Lead Auditor; SOC 2 examination experience or relevant audit credentials. * Additional valued: CEH, OSCP, or other technical security certifications demonstrating depth in offensive or operational security. Competency Requirements * Security Leadership: Ability to represent the security function credibly at Board and C-suite level; experienced in translating complex threats into business risk language. * Strategic Thinking: Ability to set a long-term security vision while managing immediate operational and compliance demands in a fast-growing, acquisition-driven organisation. * Compliance Ownership: Methodical, process-oriented, and detail-driven when managing compliance programmes; experience managing multiple concurrent audit engagements without disruption to BAU. * Crisis Leadership: Calm, decisive, and structured under pressure; proven ability to lead cyber incident response across distributed teams and communicate clearly to executive stakeholders. * Collaboration & Influence: Strong cross-functional collaborator who can engage credibly with Engineering, Product, Legal, Finance, and Business leadership to drive security outcomes without being a blocker. * Analytical & Risk-Driven: Uses data, threat intelligence, and risk frameworks to prioritise decisions, quantify security investments, and demonstrate security value to the business. * Self-directed & Adaptable: Comfortable operating autonomously at pace in a PE-backed, M&A-active, global environment where priorities evolve rapidly. Working for us  At Cyncly, we’re a global family that collaborates with humility and respect for one another. With more than 2,400 employees around the world, we not only recognize our diverse perspectives, but we also champion our different outlooks and firmly believe it to be what makes us better together. You can expect to work in a supportive and nurturing environment, with experts in their fields who strive for quality and excellence without compromising others. We also believe in a flexible and autonomous working environment that focuses on the continual growth of our employees. Diversity of experience and skills combined with passion are a key to innovation and brilliance, so we encourage applicants from all backgrounds to apply to our roles. That’s who we are: A team that recognizes our strength is in working together to not only get things done but also lead the industry with a bold approach that’s dedicated to making our customers better. Come join us. In accordance with applicable pay transparency laws, we are committed to providing clear and equitable compensation information. For this remote position, the expected salary range is $150,000 - 175,000 USD, depending on location, experience, and qualifications. This role may also be eligible for additional compensation such as bonuses, commissions, as well as a comprehensive benefits package. Candidates applying from jurisdictions with specific pay disclosure requirements (e.g., California, Colorado, New York, Washington, Illinois, British Columbia) will receive location-specific compensation details in compliance with local laws. Equal Opportunity Employer Statement:  Cyncly is committed to equal opportunity and does not discriminate based on race, color, creed, religion, gender, age, sexual orientation, national origin, disability, veteran status, or any other characteristic protected by law.  Applicants must be legally authorized to work in the country in which they are applying to work (United States or Canada). This role is not eligible for employer sponsorship now or in the future.