Director, Cybersecurity and IT Risk Management

We are seeking a Director, Cybersecurity and IT Risk Management to provide strategic leadership and operational oversight for SourceAmerica’s cybersecurity, technology risk management, security governance, incident response, third-party risk management, security awareness, and compliance readiness programs. This leader will serve as a trusted advisor to IT leadership, executive leadership, business stakeholders, governance bodies, and partners on cybersecurity risk, regulatory and contractual obligations, cyber resilience, and secure technology enablement.

This is a high-impact leadership opportunity for a cybersecurity executive who can balance mission, risk, compliance, and business enablement in a federal-contracting and nonprofit environment. The Director will help protect SourceAmerica’s information assets, systems, mission, and federal contracting obligations while also supporting nonprofit agency partners where federal contracts, Controlled Unclassified Information, or technology risk obligations apply.

SourceAmerica offers both a hybrid and remote work model. **Due to the requirements of this position, the ideal candidate would live within 30 commuting miles or less of the SourceAmerica’s National Office in Vienna, VA and work 2-3 days per week in the office.

What You’ll Do

• Lead SourceAmerica’s cybersecurity, technology risk management, and security governance functions.
• Develop and execute the enterprise cybersecurity strategy and roadmap aligned to organizational goals, federal contractor obligations, AbilityOne operational responsibilities, and risk tolerance.
• Own the cybersecurity risk management framework, including risk assessment methodology, risk register, mitigation tracking, accepted risk documentation, and executive-level reporting.
• Lead readiness and ongoing compliance activities for CMMC, NIST SP 800-171, Controlled Unclassified Information protection requirements, GSA CUI handling requirements, and other applicable federal, contractual, and regulatory security obligations.
• Oversee security operations, including threat monitoring, vulnerability management, incident response, threat mitigation, control validation, and user awareness training.
• Lead cybersecurity incident response activities, including investigation, containment, recovery, executive communication, lessons learned, and remediation tracking.
• Build and lead cybersecurity components of third-party risk management, including vendor risk tiering, due diligence, contract security requirements, cloud/SaaS assessments, ongoing monitoring, and remediation tracking.
• Provide security oversight for enterprise systems, cloud platforms, data platforms, artificial intelligence solutions, automation, and major technology initiatives.
• Support AI governance by assessing cybersecurity, privacy, data protection, vendor, and operational risks associated with approved and emerging AI tools.
• Present cybersecurity metrics, risk posture, control effectiveness, incident trends, vulnerability remediation, compliance readiness, and security program maturity to inform executive decision-making.

• Bachelor’s degree required; master’s degree, MBA, or relevant advanced training preferred.
• 15+ years of relevant cybersecurity, technology risk, security governance, or compliance experience.
• 10+ years of management experience, with demonstrated ability to lead staff, vendors, managed security service providers, and cross-functional partners.
• Current CISSP, CISM, CRISC, CISA, CGRC, or equivalent cybersecurity, risk, or compliance certification.
• Strong knowledge of cybersecurity technologies, security operations, technology risk management, security governance, and regulatory compliance practices.
• Working knowledge of NIST SP 800-171, CMMC, NIST Cybersecurity Framework, Controlled Unclassified Information requirements, and federal contractor cybersecurity expectations.
• Experience interpreting federal contract cybersecurity and CUI requirements and translating them into practical guidance for business, technology, vendor, and partner audiences.
• Experience communicating cybersecurity risk, compliance readiness, incident response matters, and mitigation priorities to executive and non-technical stakeholders.
• Ability to work independently, solve complex problems under time pressure, build relationships across a national organization, and support a mission-driven culture., * Experience leading cybersecurity programs within federal contractors, government organizations, regulated industries, or mission-driven nonprofit organizations.
• Experience supporting CMMC certification efforts, NIST SP 800-171 compliance programs, and CUI protection initiatives.
• Experience supporting cloud-first and SaaS-centric environments, including Microsoft 365, Azure, Dynamics 365, and related Microsoft security technologies.
• Experience leading third-party risk management programs, vendor security assessments, contract security reviews, and supply chain risk management initiatives.
• Experience developing cybersecurity strategy, governance structures, executive reporting, risk registers, security metrics, and policy frameworks.
• Experience presenting cybersecurity and technology risk matters to executive leadership, governance councils, audit committees, or boards.

Pulled from the full job description

• Health insurance
• Retirement plan
• Vision insurance
• Dental insurance
• Paid holidays
• Work from home, The salary for this position falls in a range between $170,000 - $180,000 depending on your experience and geographic location in the United States., We offer a comprehensive employee benefits package that includes paid holidays, vacation time, sick leave, medical, dental, and vision insurance, a solid retirement plan, and more!