Director Information Security and Infrastructure

Summary

Mirador is a fast-growing biotechnology company and we are seeking a hands-on Director, Information Security and Infrastructure. Reporting to the Vice President, Information Technology, you will own cybersecurity strategy and execution across Microsoft 365, AWS, SaaS, and on-premises lab systems, hold our managed service provider (MSP) accountable for secure network operations, and prepare the company for SOC 2, ISO 27001, SOX, and GxP audits. In your first year, the priority is a documented, tested security program: risk register, incident response plan, baseline controls, and audit-ready evidence. You will start as a hands-on leader, with the opportunity to build a team as the company scales.

Responsibilities

Security Program and Governance

• Build, own, and continually improve the cybersecurity program, including the risk register, policy and standards framework, security roadmap, and metrics, reporting regularly to the VP, IT and leadership.
• Lead governance, risk, and compliance readiness for SOC 2, ISO 27001, SOX IT general controls, and GxP/21 CFR Part 11, including control mapping, evidence collection, and audit preparation. Partner with Quality for computer system validation.
• Support privacy and data protection obligations (e.g., HIPAA, GDPR) for clinical, research, and employee data.
• Perform security reviews and risk assessments of new SaaS, cloud, AI, and third-party providers, including CROs, CDMOs, and collaborators.
• Establish and enforce policies for responsible use of AI and GenAI tools, including detection and management of unsanctioned (shadow) AI and IT.

Threat Management and Incident Response

• Serve as primary point of contact and incident lead for cybersecurity threats and incidents; develop and maintain the incident response plan, run tabletop exercises, and lead post-incident reviews.
• Oversee vulnerability management, patching, and security monitoring, including tuning of SIEM and endpoint detection and response (EDR) tools and defining response SLAs.
• Reduce risk from phishing, business email compromise, ransomware, insider threats, and intellectual property exfiltration, including evaluating and deploying data loss prevention, email security, and security awareness training.
• Lead business continuity and disaster recovery planning and testing.

Identity, Cloud, and Infrastructure

• Manage identity and access, including Microsoft Entra ID, conditional access, MFA, privileged access, joiner/mover/leaver processes, access reviews, and AWS IAM.
• Work with the cloud architect to ensure secure operation of our AWS and SaaS environments and protection of R&D intellectual property, genomic data, and clinical data.
• Act as technical liaison and accountable owner for the MSP on network infrastructure (VLANs, firewalls, routing, and segmentation of lab and on-premises systems), including defined SLAs, reporting, and runbooks.
• Oversee asset management and endpoint security using MDM and EDR tools.
• Oversee and coordinate secure implementation of system integration projects with external vendors and internal stakeholders.

Leadership and Operations

• Document IT procedures, security protocols, systems architecture, and operational runbooks.
• Educate and guide employees and business leaders on security practices, building a culture of shared risk ownership.
• Coach internal IT staff on security responsibilities and, as the company grows, recruit and develop security team members.

Experience and Qualifications

• Bachelor’s degree Computer Science, Information Technology, or a related field preferred.
• 10 or more years of experience in cybersecurity, IT infrastructure, or systems engineering, including a track record of owning or maturing a security program at a small or mid-sized organization.
• Working knowledge of cybersecurity and compliance frameworks (e.g., NIST CSF, ISO 27001, SOC 2) and experience supporting audits.
• Hands-on experience with Microsoft 365, Entra ID (Azure AD), and AWS security controls.
• Experience with EDR, MDM, and SIEM tools.
• Working knowledge of firewalls, VLANs, routing, segmentation, and core networking principles.
• Experience managing vendors, MSPs, or external technology partners against defined SLAs.

Preferred Qualifications

• Experience in life sciences, biotechnology, or other highly regulated environments, including GxP, 21 CFR Part 11, and computer system validation.
• Experience with SOX IT general controls, public company readiness, or IPO preparation.
• Certifications such as CISSP, CISM, CISA, CCSP, AWS Security Specialty, or Microsoft Security certifications.
• Experience governing secure adoption of AI and GenAI tools.

Skills and Abilities

• Excellent communication skills and the ability to articulate complex security concepts, risks, and strategies to non-technical stakeholders; educate and guide internal users.
• Builds consensus and influences stakeholders across a matrixed organization and with external providers.
• Balances hands-on execution with strategy and prioritizes effectively in a fast-growing company where one person covers multiple security disciplines.
• Strong understanding of business operations and the ability to align security initiatives with strategic company goals.
• Entrepreneurial, enjoys working in a smaller-company environment; remains calm under pressure, displays clear-head decision-making capabilities.

This role is based in the Sorrento Valley area of San Diego, CA. Occasional after-hours response may be required.

The expected base pay range for this position is $170,000 – $225,000 plus bonus, equity, and comprehensive benefits. The base pay range reflects the target range for this position, but individual pay will be determined by additional factors such as job-related skills, experience and relevant education or training. This range may be modified in the future.

#LI-onsite