DIRECTOR IT SECURITY
nordamTulsa (OK)
About the role
Position Details:
Req ID req2340 Job Title DIRECTOR IT SECURITY Division Corporate Shift First Shift Job Summary Job Summary Responsible for establishing, executing, and continuously improving the enterprise cybersecurity strategy across all systems, data, IT and OT environments – on-premise, hybrid, or cloud-based - and all operational environments. Ensures compliance with global, aerospace, and industry-specific regulatory requirements, including CMMC, NIST SP 800-171, NIST SP 800-53, NIST Cybersecurity Framework, and OEM/customer cybersecurity standards, and other global operating standards e.g. Data Privacy Framework (DPF). Oversees risk management, security operations, incident response, governance, and training across the global organization.
Essential Functions & Key Responsibilities:
Cybersecurity Leadership & Strategy - Lead development, communication, and execution of the enterprise cybersecurity strategy; govern security posture across on-premise, hybrid, OT, and Cloud environments; liaise with IT management to align existing technical solutions and skills with future architectural requirements; align security programs with organizational objectives, global operations, and regulatory obligations. Governance, Compliance & Regulatory Requirements - Oversee compliance with CMMC Level 2, NIST SP 800-171, NIST SP 800-53, DoD, aerospace OEM, and other mandated standards; maintain all required artifacts such as SSPs, POA&Ms, policies and evidence packages to support formal assessments, surveys, questionnaires and audits; drive governance practices consistent with enterprise policies, including permission governance and secure SharePoint/OneDrive data management; monitor changes in regulatory frameworks and update controls, procedures and technologies accordingly. Risk Management - Lead enterprise IT risk management, including risk assessments, remediation planning and reporting; ensure global consistency in risk treatment across business units, engineering, operations and supply chain. Security Architecture & Technology Management - Oversee design, deployment and lifecycle management of security technologies such as endpoint protection, firewalls, IDS/IPS, SIEM, identity platforms and cloud security controls; implement secure configuration baselines and vulnerability management programs. Identity, Access & Privileged Governance - Direct IAM practices including role-based access, privileged access controls and lifecycle management; govern permissions and inheritance models across collaboration systems (SharePoint/OneDrive).Data Protection & Information Security - Ensure protection of sensitive data including Controlled Unclassified Information (CUI) - using classification, encryption, retention, auditing and DLP enforcement; oversee secure design of shared repositories, collaboration sites and business data environments, e.g. M365, SharePoint/OneDrive, Teams, .NET, etc.; manage security issues and incidents to protect company assets, including intellectual property and regulated data; participate in problem and change management forums. Incident Response, Monitoring & Resilience - Direct enterprise incident response plans, threat detection, monitoring and forensics capability; conduct regular exercises and ensure all facilities maintain mature response readiness; govern disaster recovery, back-up strategies and business-continuity planning; provide strategic leadership and governance across Security Operations Center overseeing enterprise-wide incident detections, response remediation and threat investigations, directing development and continuous improvement of SOC/IR playbooks and automation and defining KRAs/KPIs that ensure measurable operational performance, risk reduction and alignment with organization security objectives. Vendor, Supplier& Partner Security - Evaluate andmanage cybersecurity posture of vendors, suppliers and joint-venture partners, e.g. third-party cyber risk management; enforce contractual and regulatorysecurity requirements across the supply chain. Policies, Procedures& Training - Create, maintainand enforce cybersecurity policies, standards and procedures across theorganization; deliver enterprise training and awareness programs tailored toIT, operations, engineering and shop-floor teams; responsible to provide robusttraining to end-users on security processes, procedures, risk and importance ofproper usage; promotes training and individual role accountability with otherdepartments.
Continuous:
Improvement - Identify andimplement ongoing enhancements to security operations, tooling and governance; drive maturity improvements tied to audit findings, risk assessments andevolving strategic goals.
Leadership & Team:
Development - Lead and developmulti-disciplinary security teams including cloud security, identitygovernance, compliance, vulnerability management and operations; fostercollaboration with IT, engineering, quality, operations, legal and supply chainto embed security into daily workflows; perform typical responsibilities ofmanagement including evaluation, organization, integration, coaching andpersonnel actions. Performs other dutiesas required. These duties may include assignments in job classifications anddepartments other than the primary assignment.
Minimum Qualifications:
- EducationRequirementsMinimum 4 Year / Bachelors Degree. Cyber Security or other IT degree
- Minimum Graduate Degree. Cyber Security or other IT degree
- If applicable, a combination of experience and training may be substituted for the education requirement.
Experience
Requirements12 - 15 or more years experience year(s) Significant experience in IT Systems, Security or Cybersecurity; implementing, managing and securing on-premise/cloud hybrid environments year(s) Security Certification such as CISSP, CISA, CCSK, CMMC, etc. year(s) NIST SP 800-171, NIST SP 800-53 or CMMC frameworks, Controlled Unclassified Information data (EAR, ITAR, CUI), Enterprise Business Systems (SAP ERP) and Microsoft 365 GCC or GCCHSupervisory/Management Experience year(s) Minimum Years of Experience year(s) Description5 or more year(s) IT management / leadership
The supervisory/management experience requirement is included in, not additional to, the overall experience requirements. year(s) Skills and Competencies
Demonstrates deep knowledge of IT security life cycle, including threat modeling, detection engineering, hardening and incident response
Solid understanding of the Cyber Kill Chain, MITRE ATT&CK, Zero Trust concepts and modern defense frameworks
Understand NIST and operationalize cybersecurity frameworks: CMMC Level 2, NIST SP 800-171, NIST SP 800-53, NIST CSF and OEM/customer security requirements
Familiar with MRP and MRP systems, including SAP, and enterprise application security considerations
Knowledge of manufacturing operations technology equipment (shop floor controls)
Cloud security expertise including Microsoft 365, Azure, identity governance, conditional access and security configuration baselines
Familiar with third party vendor relationships, vendor risk assessments and new technology/security reviews
Strong understanding of vulnerability management, patch governance, logging, monitoring, SIEM/IDS/IPS and endpoint protection lifecycle
Working knowledge in supporting international sites and global IT/security operations
Experience developing and maintaining SSPs, POA/&Ms, policies, procedures and audit evidence for compliance requirements
Knowledgeable in CUI protection, data classification, DLP controls, retention and regulatory data-handling practices
Excellent communication skills, both in written and verbal forms
Strong interpersonal skills in areas such as teamwork, facilitation, etc. Competent in use of standard software applications such as Microsoft Word, Excel, Power Point, etc. and operate standard office equipment
Make telephone and direct personal contact with internal and external personnel and make formal presentations to small or large groups
Exhibit excellent analytical skills and the ability to manage multiple projects proficiently while working in a demanding, dynamic environment; strong project management abilities
Ability to apply principles and practices of work leadership and management; communicate objectives and expectations and motivate performance
Ability to aggregate multiple sources of data into usable information in a short period of time
Ability to remediate security findings via efforts of other teams within the organization Physical Requirements Physical Requirements
Must be able to work in excess of eight (8) hours per day and five (5) days per week, if required. Additionally, those who work at NORDAM Repair Division must be able to ascend and descend stairs.
Demand - Frequency
Walk - FrequentUse hands to handle or feel or manipulate - Frequent
Reach with hands and arms - Frequent
Stoop, kneel, crouch, or crawl - Occasional
Talk and hear - FrequentUse close vision, depth perception, and ability to adjust - Constant
Travel between facilities (drive) - Occasional
Stand - Occasional
Climb stairs - Occasional
Weight - Frequency25 pounds - Occasional Work Environment Work Environment
While performing the duties of this job, the Stakeholder is occasionally exposed to moving mechanical parts, fumes or airborne particles, toxic or caustic chemicals, and outside weather conditions.
The noise level in the work environment is usually moderate. Supervision Supervision
Manages from 3 to 10 supervisory/management and/or salaried/professional Stakeholders EEO Statement The NORDAM Group LLC is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity or expression, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.
Before you apply
Applying takes about a minute. These four things decide how fast it moves after that.
Your profile is current
It's what we read first. Occupations, seniority and locations matter more than a long history.
Two examples you can talk through
Not a portfolio — just two pieces of work where you can explain the decisions and what you'd change.
A number in mind
What you're on now and what would make you move. We negotiate better when we know both.
Your notice period
Employers plan around it, and it's the question that stalls offers most often.
Once you apply, someone reads it and calls you before anything reaches the employer — usually within two working days.
More like this
