Director of Information Security & Compliance

Overview

The Director, Information Security & Compliance is responsible for leading ViaPath’s information security, vulnerability management, and compliance evidence programs. Reporting to the Senior Vice President, Enterprise Information Systems, this role combines strategic leadership and people management with direct technical and compliance engagement across cloud, infrastructure, application, container, and database environments.

The Director leads a team of security professionals and cross-functional initiatives while partnering with Enterprise Information Systems, Product, Legal and Compliance, Operations, and Engineering to embed security into enterprise architecture, product development, cloud operations, and public sector compliance programs.

A key focus of this role is leading Federal Risk and Authorization Management Program (FedRAMP) and Government Risk and Authorization Management Program (GovRAMP) initiatives, including security planning, control implementation, authorization support, continuous monitoring, remediation, evidence development, and audit readiness. The successful candidate will be a technically engaged security leader who can translate security and compliance requirements into executable programs and drive initiatives through completion.

This is a hybrid position based at the ViaPath office located in Dallas, TX.

Responsibilities

Information Security Leadership & Architecture

• Lead the development and execution of information security initiatives aligned with Enterprise Information Systems (EIS), product, compliance, and business objectives.
• Establish, implement, and validate security architecture standards and controls across hybrid and distributed environments.
• Integrate security requirements and practices into the software development life cycle (SDLC), infrastructure, cloud operations, and product lifecycle processes.
• Advance security architecture and capabilities, including zero trust, cloud security posture management, DevSecOps, identity and access management, data protection, and encryption.
• Partner with technical teams to evaluate and implement secure integrations across enterprise and cloud environments.
• Drive continuous improvement in the organization’s cybersecurity posture through automation, security metrics, process improvement, and tooling optimization.
• Translate information security strategy into actionable programs, technical requirements, remediation plans, milestones, and measurable outcomes.

Compliance, Governance, & Risk

• Lead FedRAMP, GovRAMP, National Institute of Standards and Technology (NIST) Special Publication 800-53, International Organization for Standardization (ISO) 27001, Payment Card Industry Data Security Standard (PCI DSS), System and Organization Controls 2 (SOC 2), Sarbanes-Oxley Information Technology General Controls (SOX ITGC), and related security and compliance initiatives.
• Lead FedRAMP or GovRAMP projects through readiness, assessment, authorization, and continuous monitoring, including control mapping and implementation, System Security Plan (SSP) development, Plan of Action and Milestones (POA&M) management, assessment coordination, remediation, and status reporting.
• Develop, maintain, and operationalize security policies, standards, procedures, control narratives, technical implementation documentation, and compliance evidence.
• Establish governance and documentation practices that support regulatory, customer, authorization, and enterprise audit requirements .
• Partner with Legal and Compliance, Product, and other stakeholders to address regulatory, contractual, customer, and security requirements.
• Support business continuity and disaster recovery programs to ensure alignment with information security and operational risk requirements.
• Provide executive level reporting on security posture, compliance readiness, control gaps, remediation status, and material risk exposure.

Vulnerability & Security Operations

• Lead and continuously improve vulnerability management, configuration assessment, and compliance scanning programs for servers, containers, container images, registries, web applications, databases, cloud infrastructure, and supporting network infrastructure.
• Oversee security operations activities, including security monitoring, vulnerability management, remediation tracking, control validation, incident response support, and evidence collection.
• Assess cloud security posture and configurations using cloud security posture management (CSPM), cloud infrastructure entitlement management (CIEM), vulnerability management, compliance scanning, and infrastructure-as-code review practices.
• Partner with Engineering, Infrastructure, DevOps, Product, and Operations teams to prioritize and remediate vulnerabilities, misconfigurations, insecure defaults, non-compliant baselines, and security coverage gaps.
• Establish processes and metrics to monitor vulnerability remediation, security control effectiveness, exceptions, and recurring security risks.
• Ensure security operations and vulnerability management activities produce appropriate documentation and audit-ready evidence to support FedRAMP, GovRAMP, continuous monitoring, customer assurance, and other compliance requirements.
• Support incident response activities and ensure appropriate coordination, documentation, remediation, and lessons learned.

Leadership & Cross-Functional Delivery

• Lead, develop, and provide direction to security managers, engineers, analysts, compliance professionals, and other security team members.
• Establish team priorities, performance expectations, development goals, and accountability for security and compliance deliverables.
• Maintain active technical and compliance engagement while providing strategic direction and leadership to the security function.
• Lead cross-functional security and compliance initiatives with defined objectives, milestones, ownership, dependencies, risks, and completion criteria.
• Coordinate internal teams, vendors, auditors, assessors, and business stakeholders to drive security and compliance initiatives through completion.

• Communicate complex security, compliance, and risk matters effectively to technical teams, business stakeholders, and executive leadership.
• Promote a culture of security awareness, ownership, and accountability throughout the organization.

Supervisory Responsibilities

• Directly leads security managers, engineers, analysts, compliance professionals, and other security personnel. Provides leadership and direction to cross-functional project teams vendors, consultants, auditors, and assessors supporting information security and compliance initiatives.
• This role is expected to remain technically engaged and actively involved in security architecture, compliance implementation, vulnerability and risk management, remediation planning, evidence development, and project delivery while maintaining accountability for team leadership and overall program outcomes.

Qualifications

• 12+ years of progressive experience in cybersecurity, information security, cloud security, vulnerability management, compliance, security engineering, or IT risk or related disciplines.
• Bachelor’s degree in Information Security, Computer Science, or related field (or equivalent experience)
• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), or equivalent certification.
• Demonstrated hands-on experience implementing FedRAMP or GovRAMP compliance projects, including technical control implementation and project leadership through readiness, assessment, authorization, and/or continuous monitoring.
• Strong working knowledge of National Institute of Standards and Technology Special Publications, FedRAMP, GovRAMP, continuous monitoring, Plan of Action and Milestones management, vulnerability remediation, evidence collection, control validation, and audit readiness.
• Experience implementing and operating vulnerability, configuration, and compliance scanning across servers, containers, container registries, databases, web applications, cloud services, and infrastructure components.
• Experience with cloud security, security architecture, identity and access management, data protection, DevSecOps, and security controls across hybrid or multi-cloud environments.
• Demonstrated ability to identify and assess security risks, develop practical remediation strategies, and drive remediation efforts through completion.
• Strong project and program management skills with the ability to manage multiple complex security and compliance initiatives simultaneously.
• Ability to communicate effectively with executive leadership while working directly with engineers, operations teams, auditors, assessors, and other technical and business stakeholders.

Preferred

• Experience in regulated industries such as government, telecommunications, or financial services or other highly regulated environment.
• Experience supporting organizations that provide technology products or services to government or public-sector customers.
• Experience with multiple security and compliance frameworks, including ISO 27001, PCI DSS, SOC 2, and SOX ITGC.
• Experience securing complex hybrid and multi-cloud technology environments.

Additional Information

ViaPath is committed to providing equal employment opportunities to all qualified individuals and to maintaining a workplace free from discrimination and harassment. Employment decisions are based on individual merit, qualifications, performance, and business needs. In accordance with applicable federal, state, and local laws, ViaPath does not discriminate or permit harassment against any employee or applicant based on any characteristic protected by law. ViaPath’s commitment applies to the fullest extent required by federal, state, and local laws applicable to its contracts and operations.

Benefits Overview

ViaPath is committed to supporting the health, well-being, and security of our employees. Eligible full-time employees have access to a comprehensive benefits package that includes:

• Medical, Dental & Vision Insurance – Multiple plan options designed to support a variety of coverage needs.
• Health Saving Accounts (HSA) and Flexible Spending Accounts (FSA) – Employer provided contribution to the HSA for eligible medical plans. Healthcare and dependent care spending accounts available.
• Flexible Time Off (FTO) – Including vacation and sick time
• Company Holidays
• Retirement Plan (401(k)) – Traditional and Roth 401(k) options available including employer matching contributions.
• Life & Disability Insurance – Company-paid basic life insurance and short-term disability; additional voluntary coverage available.
• Employee Assistance Program (EAP) – Free, confidential support for personal, financial, and family matters.
• Additional Well-Being Resources – Includes access to Care.com, Calm, Active&Fit, Telavet, LegalShield, and other lifestyle resources and discounted services.

Eligibility for certain benefits may depend on employee status, work location, and applicable plan documents. Benefits and terms are subject to change. The information above provides a brief summary of our benefit programs. Actual coverage details are governed by the official plan documents, which control in the event of conflict. ViaPath reserves the right to modify or terminate any benefit program at any time.