Advita Ortho

Orthopedic implants and AI-enabled surgical technologies

Director – Infrastructure and Cybersecurity

IT OperationsUpdated on Nov 13

Full-timeGainesville, FL, USANo salary listedIn-person

About the Job

Requirements

A bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and experience.
At least 10 years of experience in IT infrastructure and cybersecurity, including at least 5 years leading teams.
Direct accountability for both infrastructure operations and a security program; candidates who have led only one should be prepared to explain how the other was covered under their ownership.
Working depth across networking, server and storage, virtualization, Microsoft 365 and Azure or comparable cloud platforms, and backup and recovery.
Experience running a security program on a recognized framework, including risk assessment, vulnerability management, and incident response.
Experience in a regulated environment with formal change control and documentation requirements.
Experience owning budgets and managing vendors and managed service providers.
Sound risk judgment, including prioritizing remediation and explaining tradeoffs to non-technical audiences.
Clear writing skills for policies, standards, and executive updates.
Ability to balance technical priorities against business and financial objectives.
Ability to lead through outside service providers as well as direct staff.
Ability to decline a request and provide a workable alternative.

Responsibilities

Own the architecture, deployment, and operation of network, server, storage, endpoint, and cloud environments across all company sites.
Prioritize infrastructure work based on its effect on production uptime, quality system availability, and the ability to ship.
Own disaster recovery and business continuity for critical systems; define recovery objectives with the business, test them on a published schedule, and report results.
Direct lifecycle management, capacity planning, and modernization, maintaining a rolling multi-year plan for hardware, operating systems, and platforms approaching end of support.
Manage infrastructure supporting validated and GxP-relevant systems in coordination with Quality, ensuring changes follow validation and change control.
Establish standards for plant-floor systems, including segmentation, patching, backup, monitoring, and remote access requirements for manufacturing equipment, historians, and OT networks.
Own the service desk and end-user computing experience; publish response and resolution targets and hold internal staff and outside providers accountable to them.
Ensure infrastructure changes comply with organization-wide change management standards and are documented, reversible, and communicated in advance.
Own the cybersecurity program, including its roadmap, policies, standards, procedures, and controls, measured against a recognized framework such as ISO 27001 or NIST CSF.
Own identity and access management, including privileged access, joiner and leaver processes, and periodic access reviews for systems holding regulated or confidential data.
Own enterprise security controls across network defense, endpoint protection, email security, logging, and monitoring; maintain visibility into coverage gaps and the cost of addressing them.
Lead IT and OT vulnerability management, set remediation targets by severity, and report progress regularly.
Own incident response by maintaining and exercising the plan, defining escalation and notification paths, and leading responses when incidents occur.
Maintain an actionable risk register with named owners, treatment decisions, and dates; lead periodic risk assessments and report changes over time.
Ensure controls over electronic records and signatures meet FDA 21 CFR Part 11 expectations and that IT controls supporting the quality system withstand audits.
Support internal audits, customer security questionnaires, and regulatory inspections; keep evidence and documentation current.
Manage third-party and supply chain risk by assessing vendors and service providers before granting access to company systems or data and reassessing them on a defined schedule.
Partner with business leaders to make controls fit actual workflows and propose workable alternatives when controls create friction.
Provide direction and leadership to infrastructure and security teams; recruit, develop, and retain staff and build sufficient team depth for critical systems.
Develop and manage operating and capital budgets for both mandates, make spending tradeoffs, and defend them.
Evaluate, select, and manage technology vendors and managed service providers; hold contracts and service levels accountable and change providers when needed.
Communicate infrastructure and security risk to technical and non-technical audiences and give the executive team a current, usable picture.
Maintain regular written and in-person communication with executives, department heads, and end users about planned work, outages, and changes.
Act as liaison among IT, Quality, Operations, and Commercial on technology decisions affecting regulated processes.
Support applicable regulatory and contractual obligations across company markets, including FDA 21 CFR Part 11 and Part 820, ISO 13485, and, where relevant, HIPAA, GDPR, and EU MDR requirements.

Desired Qualifications

Medical device, pharmaceutical, or other FDA-regulated manufacturing experience.
Working knowledge of FDA 21 CFR Part 11, 21 CFR Part 820 and the transition to QMSR, and ISO 13485 as they apply to IT systems.
Experience securing manufacturing or OT environments, including segmentation of production networks and equipment running unsupported operating systems.
Experience supporting ERP and MES platforms in a manufacturing setting.
CISSP, CISM, CISA, or an equivalent security certification; PMP or an equivalent project management credential.
Experience in a private equity-backed or acquisitive company.

The Director of Infrastructure and Cybersecurity leads both disciplines for Advita with equal weight. The role owns the systems that keep manufacturing, quality, and commercial operations running, and it owns the security program that protects Advita’s intellectual property, design and production data, and regulated electronic records. This is a working leadership role in a validated, FDA-regulated manufacturing environment. The Director is expected to be close enough to the technology to make sound architecture and risk decisions, and senior enough to set direction, own the budget, and represent both agendas to the executive team. Neither mandate is treated as secondary to the other.

Infrastructure

Own the architecture, deployment, and operation of network, server, storage, endpoint, and cloud environments across all Advita sites.
Prioritize infrastructure work by its effect on production uptime, quality system availability, and the ability to ship. Manufacturing continuity is the first test of any infrastructure decision.
Own disaster recovery and business continuity for critical systems. Define recovery objectives with the business, test them on a published schedule, and report the results.
Direct lifecycle management, capacity planning, and modernization. Maintain a rolling multi-year plan for hardware, operating systems, and platforms approaching end of support.
Manage the infrastructure supporting validated and GxP-relevant systems in coordination with Quality. Ensure changes move through validation and change control rather than around them.
Bring the plant floor under a defined standard. Establish segmentation, patching, backup, monitoring, and remote access requirements for manufacturing equipment, historians, and OT networks.
Own the service desk and end-user computing experience. Publish response and resolution targets and hold internal staff and outside providers to them.
Ensure infrastructure changes conform to organization-wide change management standards and are documented, reversible, and communicated in advance.

Cybersecurity

Own Advita’s cybersecurity program: roadmap, policies, standards, procedures, and controls, measured against a named framework such as ISO 27001 or NIST CSF rather than against opinion.
Own identity and access management, including privileged access, joiner and leaver processes, and periodic access reviews for systems holding regulated or confidential data.
Own enterprise security controls across network defense, endpoint protection, email security, logging, and monitoring. Maintain a clear view of what is covered, what is not, and what closing the gap costs.
Lead vulnerability management across both IT and OT, with remediation targets by severity and regular reporting against them.
Own incident response. Maintain and exercise the plan, define escalation and notification paths, and lead the response when an incident occurs.
Maintain a risk register leadership can act on, with named owners, treatment decisions, and dates. Lead periodic risk assessments and report movement over time.
Ensure controls over electronic records and signatures meet FDA 21 CFR Part 11 expectations, and that IT controls supporting the quality system hold up under audit.
Support internal audits, customer security questionnaires, and regulatory inspections. Keep evidence and documentation current so audits do not become projects.
Manage third-party and supply chain risk. Assess vendors and service providers before they receive access to Advita systems or data, and reassess on a defined schedule.
Partner with business leaders so controls fit how the work is actually done. Where a control creates real friction, propose a workable alternative rather than an exception.

Leadership, Vendor & Financial Responsibilities

Provide direction and leadership to the infrastructure and security teams. Recruit, develop, and retain staff, and build enough depth that no critical system depends on one person.
Develop and manage the operating and capital budgets for both mandates. Make spend tradeoffs and defend them.
Evaluate, select, and manage technology vendors and managed service providers. Hold contracts and service levels accountable and be prepared to change providers who underperform.
Communicate infrastructure and security risk to technical and non-technical audiences. Give the executive team a current, usable picture without requiring them to interpret technical detail.
Maintain regular written and in-person communication with executives, department heads, and end users regarding planned work, outages, and changes.
Act as the liaison between IT, Quality, Operations, and Commercial on technology decisions affecting regulated processes.
Support applicable regulatory and contractual obligations across Advita’s markets, including FDA 21 CFR Part 11 and Part 820, ISO 13485, and, where relevant to Advita’s data and geographies, HIPAA, GDPR, and EU MDR requirements.

Education

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field, or an equivalent combination of education and experience.

Required Experience

10+ years in IT infrastructure and cybersecurity, including at least 5 years leading teams.
Direct accountability for both infrastructure operations and a security program. Candidates who have led only one of the two should be prepared to show how the other was covered under their ownership.
Working depth across networking, server and storage, virtualization, Microsoft 365 and Azure or comparable cloud platforms, and backup and recovery.
Experience running a security program on a recognized framework, including risk assessment, vulnerability management, and incident response.
Experience in a regulated environment with formal change control and documentation requirements.
Experience owning budgets and managing vendors and managed service providers.

Skills, Credentials, and Knowledge

Sound risk judgment. Able to separate what must be fixed now from what can be scheduled, and to explain the difference to a non-technical audience.
Clear writing. Policies, standards, and executive updates that people can act on without translation.
Ability to balance technical priorities against business and financial objectives.
Ability to lead through outside service providers as well as direct staff.
Comfort declining a request with a workable alternative attached.

Preferred

Medical device, pharmaceutical, or other FDA-regulated manufacturing experience.
Working knowledge of FDA 21 CFR Part 11, 21 CFR Part 820 and the transition to QMSR, and ISO 13485 as they apply to IT systems.
Experience securing manufacturing or OT environments, including segmentation of production networks and equipment running unsupported operating systems.
Experience supporting ERP and MES platforms in a manufacturing setting.
CISSP, CISM, CISA, or an equivalent security certification. PMP or equivalent project management credential.
Experience in a private equity backed or acquisitive company.

About the Company

Advita Ortho

Orthopedic implants and AI-enabled surgical technologies

Advita Ortho designs and sells orthopedic implants and integrated surgical technologies, including established lines like Equinoxe Shoulder, Vantage Ankle, Alteon Hip, and Truliant Knee. Its products pair implants with tools such as Newton balancing technology and GPS navigation to guide surgeries, while using data, AI, and machine learning to build a surgical ecosystem that supports in-OR decision-making. The company differentiates itself by combining hardware with data-driven software to improve efficiency and outcomes, backed by experienced leadership and significant financial support from its investors. Its goal is to deliver high-quality implants and connected surgical technology that enhance patient outcomes and streamline operating-room workflow globally.

Company size: 201-500
Company stage: Debt Financing
Total funding: $35M
Headquarters: Gainesville, FL
Founded: 2025

Recently Posted Jobs

Explore more opportunities at Advita Ortho

See more jobs