Director of Information Security Job Description

A Director of Information Security owns the machinery of an organization's security program. Strategy may be set with a chief information security officer, a chief information officer or the board, but the director turns it into staffed teams, funded projects, written policy and controls that can survive an audit. When something breaks, the director has to explain what happened, what it cost and what will change.

The federal government's own description of senior security leadership captures the scope. The NICE Workforce Framework, published through CISA's NICCS site, defines the Executive Cybersecurity Leadership work role (OG-WRL-007) as responsible for establishing vision and direction for an organization's cybersecurity operations and resources, with authority to make and execute decisions that affect the organization broadly, including policy approval. Its task list includes developing organizational cybersecurity strategy and establishing a cybersecurity risk management program. A director at a large company may share that work with a CISO; at a mid-sized company the director may be the most senior security person on staff.

The program, piece by piece

The job is easiest to understand as a set of programs that each need an owner and a metric:

• Security operations: the SOC or managed detection provider, the SIEM (Splunk, Microsoft Sentinel and similar), EDR tooling such as CrowdStrike Falcon or Microsoft Defender for Endpoint, and the on-call rota.
• Vulnerability management: scanning with tools such as Tenable or Qualys, patch deadlines by severity, and the exceptions process when a system cannot be patched.
• Identity and access: single sign-on, multi-factor authentication, privileged access vaults, and access reviews that someone actually signs.
• Governance, risk and compliance: the risk register, policies, control testing and the audit calendar for frameworks such as NIST CSF, ISO/IEC 27001, SOC 2 or PCI DSS.
• Third-party and cloud risk: vendor questionnaires, contract clauses and posture management for cloud accounts.

Two audiences

Half the job faces inward, toward analysts and engineers who need priorities, budget and cover when they block a risky change. The other half faces upward. Executives want to know whether the company is safer than last quarter, and a good director answers with a few stable measures, such as time to patch critical flaws or the share of accounts on phishing-resistant authentication, rather than raw alert counts.

Incidents

During a serious incident the director coordinates the technical response: isolating systems, calling in the forensics retainer, preserving evidence, and keeping legal counsel and communications staff working from the same facts. Afterward the director runs the review and turns its findings into funded fixes, which is where the strategy and the budget meet again.

Education

The usual starting point is a bachelor's degree in a computing field: computer science, cybersecurity, or management information systems. For computer and information systems managers as a whole, BLS lists a bachelor's degree as the typical entry-level education and 5 years or more of work experience in a related occupation. Some directors add a master's degree in cybersecurity management or an MBA, which helps when the job involves budget negotiations with finance leaders, though a graduate degree is guidance rather than a rule.

Experience

As a rough guide, directors arrive after roughly a decade in security or adjacent IT work, including several years managing people. Typical starting lanes:

• Security engineering or architecture, building the controls the director later governs.
• Security operations, rising from analyst to SOC manager and learning incident command along the way.
• Audit, risk and compliance, where the strength is control design and regulator-ready documentation.
• IT infrastructure or cloud engineering, moving into security through identity, network or cloud platform work.

Candidates strengthen their case with evidence of ownership: a program the candidate built or rebuilt, a budget they ran, a serious incident they managed, and an audit they took through to a clean result.

Credentials

These are the certifications a candidate would realistically pursue, each with its awarding body:

• CISSP (Certified Information Systems Security Professional), from ISC2, the broad security credential.
• ISSMP (Information Systems Security Management Professional), an ISC2 concentration for security managers.
• CISM (Certified Information Security Manager), from ISACA, centered on program governance and incident management.
• CRISC (Certified in Risk and Information Systems Control), from ISACA, for enterprise IT risk.
• CCSP (Certified Cloud Security Professional), from ISC2, for cloud-heavy environments.

Ask about employer support for credentials. In ISACA's 2026 global State of Cybersecurity survey, 61 percent of respondents said their employer pays certification fees.

Skills that separate candidates

• Turning technical findings into business risk with a cost, an owner and a deadline.
• Writing policy that engineers can follow and auditors can test.
• Reading contracts: security clauses, breach notification terms and liability caps in vendor agreements.
• Hiring and retaining people, including building career ladders for analysts.
• Working knowledge of the platforms the team runs, enough to challenge a vendor's claims or an engineer's estimate.
• Calm, clear communication during an incident, when executives want answers before the facts are in.

BLS projects employment of computer and information systems managers, the occupation that includes security directors, to grow 16 percent from 2025 to 2035, much faster than the average for all occupations, with about 53,500 openings a year on average. BLS ties the demand to businesses building out IT infrastructure such as cloud computing, cybersecurity, digital platforms and artificial intelligence. Those figures describe the wider occupation; BLS does not project security directors on their own.

Keeping a team together

Retention is a real part of the job. ISACA's 2026 State of Cybersecurity report, a global survey of more than 1,800 cybersecurity professionals published October 5, 2026, found that more than half (55 percent) of respondents report difficulty retaining qualified cybersecurity professionals. High work stress was the leading reason people leave, cited by 52 percent, followed by limited promotion and development opportunities at 47 percent. For a director, that makes workload planning, sane on-call rotations and visible career paths part of the security program rather than a human resources side task.

Rules still in motion

Healthcare security programs face a rule that has not yet arrived. HHS's Office for Civil Rights published a proposed rule to strengthen the HIPAA Security Rule in the Federal Register on January 6, 2025 (90 FR 898). The Unified Agenda lists the rule, RIN 0945-AA22, under long-term actions, with a final action date of July 2027. Until a final rule appears, the existing Security Rule is the one that applies, and directors at hospitals and health plans plan around a proposal rather than a requirement.

AI governance is in a similar state. NIST released the Cybersecurity Framework Profile for Artificial Intelligence, NIST IR 8596, as an initial preliminary draft on December 16, 2025, and its public comment period closed January 30, 2026. It remains a draft. Directors who map their AI controls to it now are working from a document that may still change, so it makes sense to treat the mapping as a living file rather than a finished audit artifact.

Where the work goes next

One next step is the CISO seat, either at the same organization or at a smaller one where the director's program experience counts as executive experience. Other directions include vice president of security roles at large companies, security leadership at a managed security provider, and advisory work for organizations that cannot yet fund a full-time security executive.

Sector choice shapes the job as much as title. A director at a bank lives with examiners and written board reports; one at a software company spends more time on product security and customer security questionnaires; one at a university balances open research networks against data protection duties. Candidates who have run security in more than one of those settings can speak to a wider range of risks when they interview for the top job.

The skills that carry a director upward are the same ones the job tests daily: budget discipline, honest risk reporting, steady incident leadership, and the ability to keep good people on the team.

Dear Hiring Committee,

I am applying for the Director of Information Security role at Harborline Mutual. For the past six years I have led security operations and governance at a regional insurer, and I would like to bring that experience to a larger program with a direct line to your board.

When I joined my current employer, security was three engineers and a stack of tools nobody owned. I reorganized the group into operations, engineering and risk teams, wrote a two-year roadmap the CIO could fund in stages, and replaced a patchwork of scanners and agents with one EDR platform and a managed detection partner that covers nights and weekends. I also built a short quarterly scorecard for executives that tracks patch timeliness, privileged account reviews and open audit findings, so the conversation moved from how many alerts we saw to which risks were still open.

Last spring a phishing campaign compromised a claims adjuster's mailbox. I led the response: we contained the account within the hour, brought in our forensics retainer, worked with counsel on notification decisions, and briefed the executive team twice a day until we closed the case. The review produced four fixes, all funded and finished within the quarter.

I hold the CISSP and CISM, and I care about the people side of the job as much as the technical side. Two analysts I hired have since become team leads.

I would welcome the chance to discuss how I could help Harborline Mutual strengthen its program and its reporting to the board.

Sincerely, Daniel Okafor