United States
Published on: November 9, 2026
Openings: 1 | Work arrangement: Remote | Location: United States and Canada | Employment type: Direct Hire | Role type: Newly Created Position
About Our Client
Our client is a growing SaaS company that develops software for utility damage prevention and infrastructure risk management. Gas, electric, telecommunications, and pipeline operators across the United States and Canada rely on its products to protect critical infrastructure. Because its customers operate critical infrastructure, the company is held to rigorous security standards and expected to maintain strong security practices.
Role Overview
We're looking for a Director of Cybersecurity to own and mature the company's security program across its SaaS products and corporate IT. This is a hands-on leadership role: you will do the technical work, from triaging vulnerabilities to leading incident response, while setting security standards and policy and partnering with engineering, infrastructure, IT, GRC, and executive leadership. You will work in a multi-cloud environment (AWS and Microsoft Azure, with limited GCP) that supports multiple products across production, development and test, and corporate systems. Hands-on cloud security skills and the ability to drive findings through to verified remediation matter most. Experience securing SaaS products is prioritized, and experience with utilities, pipelines, or other critical infrastructure customers is a strong plus.
Key Responsibilities
Vulnerability Management and Remediation
Own the triage and prioritization of security findings from SAST tools, infrastructure security assessments, penetration tests, and newly disclosed CVEs.
Assess risk and severity, set remediation priorities, and assign owners and deadlines.
Partner with engineering and infrastructure teams to resolve vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning.
Integrate security findings into engineering work management systems so every finding has an assigned owner, a tracking ticket, and a target remediation date.
Verify that fixes work, and report remediation progress, outstanding risks, and security trends to IT, engineering, and executive leadership.
Provide vulnerability and remediation updates to customers as appropriate.
Incident Response and Security Communications
Lead security incident response from initial detection and investigation through containment, remediation, and post-incident review.
Coordinate urgent vulnerability and CVE responses across technical teams.
Manage incident communications, including internal status updates, executive briefings, and Customer Experience talking points.
Prepare accurate, timely customer-facing communications on potential exposure, remediation status, and detection activity.
Maintain incident response runbooks and on-call escalation procedures.
Run regular incident response tabletop exercises.
Cloud, Identity and Access Security
Own cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.
Establish and enforce identity and access management policies covering least-privilege access, role-based access, session duration and expiration, multi-factor authentication (MFA), privileged access management, and employee and contractor onboarding, transfers, and offboarding.
Manage and strengthen identity controls across Microsoft Entra ID and AWS IAM.
Conduct regular access reviews for employees, contractors, and third-party vendors.
Identify and remediate excessive permissions, inactive accounts, and access control gaps.
Security Policy, Compliance and Customer Trust
Develop, maintain, and enforce security policies, standards, and procedures aligned with the NIST Cybersecurity Framework (CSF) and ISO 27001.
Own the technical security controls supporting SOC 2 Type II and ISO 27001 compliance.
Partner with Governance, Risk, and Compliance (GRC) teams on audit readiness, evidence collection, and remediation of control gaps.
Monitor regulatory and industry requirements affecting critical infrastructure customers, including TSA pipeline security directives, NERC CIP-related customer security expectations, and applicable Canadian privacy legislation, and translate them into practical technical controls.
Lead technical responses to customer security questionnaires with GRC, and represent the company's security program in customer security reviews and calls.
Manage third-party penetration testing engagements and security vendors.
Support cybersecurity due diligence for acquisitions.
Requirements
8+ years of experience in cybersecurity engineering or security operations, including at least 3 years leading a security program or function, preferably within a SaaS organization.
Hands-on cloud security experience across AWS and Microsoft Azure, including identity and access management (IAM), cloud network security controls, and security logging, monitoring, and audit trails (AWS CloudTrail and Microsoft Entra sign-in and audit logs).
Experience with cloud security posture management tools such as Wiz.
Demonstrated end-to-end ownership of vulnerability management: identifying, triaging, prioritizing, assigning, tracking, and driving remediation in partnership with engineering teams.
Proven experience leading security incident response, including delivering clear, timely written communications to executive leadership and customers in high-pressure situations.
Working knowledge of SOC 2 Type II, ISO 27001, and NIST CSF, including experience as a key technical control owner through at least one SOC 2 Type II audit.
Ability to review and interpret application code, infrastructure as code (IaC), and Linux and Windows server configurations to evaluate security risks and validate remediation approaches.
Strong written and verbal communication skills, sound technical judgment, and the ability to tell which issues need immediate escalation and which can be resolved through routine remediation.
Nice-to-Have
Experience supporting utilities, pipelines, energy providers, or other critical infrastructure customers, including familiarity with TSA pipeline security directives or NERC CIP requirements.
Background in regulated industries such as healthcare or financial services.
Hands-on Microsoft 365 security, Microsoft Purview, data protection, and privacy control experience.
Experience with SentinelOne or other endpoint security tools.
Familiarity with Canadian privacy requirements, including Quebec's Law 25.
Experience conducting cybersecurity due diligence or supporting security integration after mergers and acquisitions.
Experience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.
People management experience.
Relevant industry certifications.
Benefits
Join a dynamic, growing company with a strong reputation in its industry.
Competitive salary.
Comprehensive health plan options, including medical, dental, and vision coverage.
401(k) plan with company match.
Flexible PTO policy plus company-paid holidays.
Additional benefits, including life insurance, pet insurance, and employee discounts and perks programs.
Generous one-time work-from-home stipend to help you set up your home workspace.
Company events and opportunities to connect, including monthly team lunches, volunteer outings, and quarterly gatherings.
As part of our hiring process, this role may use artificial intelligence or automated tools to assist with reviewing and screening applications. These tools support, but do not replace, human judgment in making hiring decisions.
Your application will only be counted once you complete the full registration process on the KeyStone platform, including creating your profile, uploading your CV, and submitting your application. The AI interview is optional and encouraged, but is not required for your application to be counted.
As part of our hiring process, this role may use Keystone AI’s artificial intelligence or automated tools to assist with reviewing and screening applications. These tools support, but do not replace, human judgment in making hiring decisions.
Your application will be considered complete only after you have completed the full registration process on the Keystone AI platform, including creating your profile, uploading your CV, and submitting your application. The AI interview is optional but encouraged and is not required for your application to be considered.
By submitting your personal data and/or resume, you give consent to collection, use and disclosure of your personal data and/or resume by the company (or its agent) for the purpose of the processing and administration by the company relating to this job application. Read our Privacy Policy.
CGP Group is an affirmative equal-opportunity employer and recruitment firm. We evaluate qualified applicants without regard to race, color, religion, creed, gender, sexual orientation, gender identity, marital status, national origin, age, veteran status, disability, or any other protected class. Information provided in this advertisement is for recruitment purposes only.