> Markdown version of [/jobs/ext/1148082-vice-president-cybersecurity-and-deputy-chief-information-security-officer](https://www.wearedevelopers.com/jobs/ext/1148082-vice-president-cybersecurity-and-deputy-chief-information-security-officer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Vice President, Cybersecurity and Deputy Chief Information Security Officer - **Company:** New York Times - **Location:** New York, NY, United States - **Experience:** Expert - **Salary:** $275,000.0 - $290,000.0 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Cloud Computing Security, Cyber Security, Software Design Patterns, Disaster Recovery, Identity and Access Management, Intrusion Detection and Prevention, Information Systems Security Architecture Professional, Key Management, Web Application Security, Security Information and Event Management, Software Vulnerability Management, Enterprise Software Applications, Software Security, Purple Team (Cyber Security) - **Published:** July 2, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=8e5a596928740487 ## About the Role * 12+ years of progressive experience in cybersecurity or information security, including leadership of large, complex security programs * Experience leading multiple security domains, such as security engineering, security operations, incident response, cloud security, identity, application security or GRC * Prior experience in a VP, Head of Security, Deputy CISO or similar senior leadership role with accountability for both strategy and execution * Deep technical understanding of modern security architectures, including cloud (AWS, GCP or similar), network, endpoint, identity and application security * Proven track record leading major incident response efforts and security crisis management, including communication with executives and external stakeholders * Strong familiarity with industry frameworks and standards such as NIST CSF, ISO 27001, SOC 2, PCI, HIPAA and data protection regulations * Experience working in close partnership with teams across Legal, Privacy, HR, Finance, Internal Audit and external regulators or auditors * Expertise building and leading diverse teams, including developing senior managers and cross-functional leaders Additional Qualifications: * Experience securing media, news, technology or similarly fast-paced, high-profile environments with unique threat models * Background working directly with or supporting newsroom, high-risk user or investigative teams * Experience presenting to boards or audit committees and supporting public-company security and risk disclosures * Experience operating in a global context, including international offices, complex regulatory environments and cross-border data considerations * Prior experience shaping AI governance, AI security or emerging-technology security programs ## Description As Vice President, Cybersecurity and Deputy CISO, you will translate our cybersecurity strategy into operational reality. You will: * Lead and integrate core security functions, including security architecture and engineering, threat detection and incident response, security operations, identity and access management, and risk and compliance. * Own day-to-day cybersecurity program execution, including annual planning, roadmap delivery, operational reviews and metrics. * Serve as the primary operational escalation point for significant security risks and incidents, partnering closely with Global Security, Legal, Communications, Enterprise Technology and business leaders. * Act as a visible security leader with executives, senior editors and technology leaders, helping them understand risk, tradeoffs and priorities in practical terms. * Serve as acting CISO when needed, including during executive forums, audits and key stakeholder meetings. This is a hybrid role based in our New York City headquarters, reporting to the CISO and Head of Enterprise Technology. You can typically expect to come into the office 3+ days per week., Program leadership and strategy execution * Own the day-to-day execution of the cybersecurity strategy and roadmap, ensuring alignment with company and Technology priorities * Translate high-level risk and board-level objectives into concrete programs, projects and measurable outcomes * Strategically manage the Cybersecurity budget, including coordinating with finance, setting multi-year forecasts, and managing billing workflows for Cybersecurity vendors * Establish and run operating rhythms for Cybersecurity, including staff meetings, portfolio reviews, operational reviews, OKRs and metrics * Partner with the CISO on multi-year planning, budget development and investment prioritization across tools, people and services * Drive continuous improvement using internal metrics, external benchmarks and findings from assessments, incidents and exercises Security architecture, engineering and operations * Provide senior leadership across security engineering, architecture and operations, ensuring our security stack is robust, observable and well-integrated with Enterprise Technology and Developer Platforms * Guide the evolution of core controls such as endpoint protection, EDR, SIEM, email security, web security, vulnerability management, secrets management, MDM and identity governance * Partner with Enterprise Technology, Developer Platforms and product engineering to embed secure-by-design patterns, guardrails and self-service controls into platforms and workflows * Provide oversight and strategic direction for identity and access management, including identity platforms, access orchestration and privileged access * Ensure operational excellence for security tooling, including lifecycle management, vendor relationships and integration with incident response and monitoring workflows Detection, incident response and resilience * Oversee threat detection, monitoring and incident response programs, including a modern, automation-forward SOC capability. * Serve as senior escalation leader for high-severity incidents, driving real-time decision-making, cross-functional coordination and executive communications * Ensure playbooks, tabletop exercises, red/purple team activities and crisis management plans are in place, tested and regularly updated. * Partner with Global Security, Business Continuity and Enterprise Technology on integrated resilience programs, including disaster recovery, crisis response and resilience exercises * Ensure post-incident reviews lead to durable improvements in controls, processes and architecture Governance, risk, compliance and security education * Lead cybersecurity governance and risk management frameworks in alignment with NIST CSF 2.0 and other relevant standards * Drive the development and use of risk metrics, control health indicators and dashboards to communicate security posture to executives, Audit Committee and other stakeholders * Strategically support security education programs to ensure a metrics-driven approach to providing relevant training and resources to our staff Newsroom and high-risk user security * Partner with newsroom teams to support the unique threat models of journalists and other high-risk users. * Ensure security measures and controls enable, rather than impede, high-stakes newsgathering, international reporting and sensitive investigative work * Support programs that protect journalists and high-risk staff across travel, field operations, online harassment and digital threats People leadership and culture * Lead, mentor and develop senior managers and staff across multiple security disciplines, building a high-performing, inclusive and collaborative team * Foster a growth-minded, metrics-driven, blameless culture focused on learning and continuous improvement * Support career paths, succession planning and leadership development across Cybersecurity, including preparing future CISO-level leaders * Help champion security awareness and education programs that engage staff at all levels in shared security ownership * Engage in cross-industry collaboration and knowledge sharing to ensure that The New York Times is up-to-date on latest security events, techniques, and industry norms * Demonstrate support and understanding of our value of journalistic independence and a strong commitment to our mission to seek the truth and help people understand the world, Please beware of fraudulent job postings. Scammers may post fraudulent job opportunities, and they may even make fraudulent employment offers. This is done by bad actors to collect personal information and money from victims. All legitimate job opportunities from The New York Times will be accessible through The New York Times careers site. The New York Times will not ask job applicants for financial information or for payment, and will not refer you to a third party to do so. You should never send money to anyone who suggests they can provide employment with The New York Times. ## Related Videos - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Convincing Product teams to Adopt Gitops in a Large Org](https://www.wearedevelopers.com/videos/1936-convincing-product-teams-to-adopt-gitops-in-a-large-org) - [This Machine Ends Data Breaches](https://www.wearedevelopers.com/videos/574-this-machine-ends-data-breaches) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Organizational Change Through The Power Of Why - DevSecOps Enablement](https://www.wearedevelopers.com/videos/478-organizational-change-through-the-power-of-why-devsecops-enablement) - [System Resilience: Surviving the Software Storm](https://www.wearedevelopers.com/videos/874-system-resilience-surviving-the-software-storm) ## Related Articles - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Coffee with Developers - Maria Apazoglou - Making AI understandable for all in production](https://www.wearedevelopers.com/magazine/475-coffee-with-developers-maria-apazoglou-making-ai-understandable-for-all-in-production) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)