Director, Global Information Security

Position Title: Director, Global Information Security Department: Information Technology (IT) Location: Remote in CT, DC, FL, GA, IL, MD, MA, NC, NJ, NY, OR, PA, Puerto Rico, TN, TX, VA, or WA Travel Required: 10% Reports to: Vice President, Information Technology Number of Direct Reports: 0 Assignment Type: Full-time; Exempt Compensation: $137,319 to $150,900 Application Requirements: Resume; Completed application questions About Americares: Global Health Starts with YOU! Americares is a global health and disaster relief organization that helps people and communities around the world access health in times of disaster and every day. Each year, Americares reaches 85 countries on average, including the United States, with life-changing health programs, medicine, medical supplies and emergency aid. Americares is one of the world’s leading nonprofit providers of donated medicine and medical supplies. For more information, visit americares.org. Americares Values: We create global community, treating people as they want to be treated. We respond effectively and responsibly, putting plans into practice. We embed ethics and equity in our work and workplace. We are better together; partnership is at our core. We ask and listen, to create sustainable solutions for a healthier tomorrow. We commit to quality, growing and improving to ensure individuals and communities thrive. About the Position: The Director, Global Information Security will own and advance information security across our globally distributed humanitarian organization operating in high-risk environments, building and advancing our information security program, deepening partnerships, and sharpening a cybersecurity culture to keep Americares safe, resilient, and trusted. With a technology footprint that spans country offices across multiple regions, a growing cloud and SaaS environment, and an expanding set of donor, partner, and beneficiary data obligations, Americares seeks dedicated, expert ownership of information security to operate responsibly at this scale. The Director, Global Information Security will play a critical role in leading the organization through a period of digital transformation, expanding the use of cloud platforms, data analytics, and AI-enabled tools across our global operations. Duties and Responsibilities: Own and advance Americares global information security program, including policy development, governance frameworks, security standards, and cybersecurity culture across HQ and country office operations worldwide. Lead and oversee all managed security services and vendor relationships, including MDR/SOC provider performance, endpoint protection, email security, CIS membership and assessments, and cyber insurance compliance, ensuring vendors are held accountable to clear standards and delivering measurable value. Conduct and manage CIS-based security assessments, produce prioritized risk registers and remediation roadmaps, oversee vulnerability management including risk ranking, remediation tracking, and exception handling, and report progress against the security roadmap to leadership. Own the cybersecurity incident response plan, including maintenance, tabletop exercises, staff training, and active coordination with internal teams, including Legal, Compliance and Risk Management (LCRM), Finance, Communications, and country offices during incidents, ensuring alignment with the organization's broader crisis management and business continuity processes. Partner with Technology Operations, Data Management and Enterprise Applications, Legal Compliance and Risk Management, and Global Safety and Security to define, validate, and maintain security requirements across infrastructure, applications, identity, data, and physical security. Oversee day-to-day security operations including SOC/MDR ticket review, escalation management, service quality oversight, identity and access control validation, and correlation of signals across endpoint, email, cloud, and network environments. Represent Americares in peer security communities including NetHope and NGO-ISAC, serve as the internal subject matter expert on cybersecurity for leadership, and build a security-aware culture across a globally distributed workforce through awareness programs, policy socialization, and change management. Actively model and contribute to Americares values, work culture and mission. Engage in and contribute to team spaces with openness, global competencies, and a growth mindset. Other duties and responsibilities as assigned. In the first 90 days: Learn and live the Americares values. Complete all required new hire onboarding trainings. Demonstrate an understanding of Americares programmatic work and business models. Review IT policies and relevant vendor agreements. Develop a deep understanding of our information security posture. Document an initial understanding of Americares cybersecurity architecture, including the current state of endpoint protection, identity and access management, email security, cloud security, and SOC/MDR coverage, and identify immediate gaps requiring attention. Begin to develop strong relationships towards becoming a key partner with critical stakeholders, including: Technology Operations, Legal, Compliance and Risk Management (LCRM), Global Safety and Security (physical security), Data Management Enterprise Applications team, country office leadership, and external vendors and suppliers. Establish a regular reporting cadence with the VP, Information Technology on security posture, active risks, and priority actions. In close partnership with the Technology Operations team, LCRM, country office management teams and other relevant stakeholders, lead the review of the results from externally conducted CIS assessment and develop a prioritized risk register, recommended remediation roadmap, mitigation strategies, and a briefing for leadership. In the first 6 months: Develop a long-term global information security strategy and roadmap that aligns with Americares strategic objectives over the next 5 years. Socialize and garner necessary buy-in and support for roadmap across the organization. Identify and plan for necessary resources for roadmap in FY28. Own the cybersecurity Incident Plan, making updates as needed, and train relevant stakeholders. Ensure the cybersecurity Incident Plan is coordinated with the organization's crisis management and business continuity processes so the incident plan reflects operational continuity beyond the technical response. In the first year: Complete Phase I of the information security roadmap. Achieve significant organization-wide understanding and adoption of IT policies and security SOPs through socialization and change management. Demonstrate improvement in CIS assessment scores based on positive impact from the cybersecurity roadmap. Degrees/Certifications that are required for the role: CISM, CISSP, CySA+, Security+, or Microsoft security certifications such as SC-200 or SC-300 Competencies required for the role include: Influence and Functional Authority : Achieves security outcomes through people and teams who do not report to them. Builds credibility with peers in Infrastructure, Data Management, Enterprise Applications, Legal, and country operations. Sets clear expectations and holds others accountable through relationship and expertise rather than positional authority. Knows when to escalate to the VP and when to resolve laterally. Security Judgment and Risk Communication: Translates complex and evolving cybersecurity risks into clear, actionable language for non-technical audiences including leadership, Legal, country directors, and program staff. Makes sound risk prioritization decisions under uncertainty and resource constraints. Knows what to escalate, what to absorb, and what to defer. Program Building in a Resource-Constrained Environment: Has built or materially advanced a security program without a large team or budget. Comfor