> Markdown version of [/jobs/ext/3097427-vice-president-cybersecurity-risk-compliance-deputy-ciso](https://www.wearedevelopers.com/jobs/ext/3097427-vice-president-cybersecurity-risk-compliance-deputy-ciso). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Vice President, Cybersecurity, Risk & Compliance (Deputy CISO) - **Company:** Idc Inc - **Location:** Boston, MA, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Software System Penetration Testing, Application Portfolio Management, Software as a Service, Cloud Computing, Cyber Security, Continuous Integration, DevOps, Monitoring of Systems, Identity and Access Management, Intrusion Detection and Prevention, Zero Trust Network Access, Security Assertion Markup Language (SAML), Secure Coding, Security Information and Event Management, Single Sign-On, Data Logging, Enterprise Software Applications, Cloud Platform System, Delivery Pipeline, Large Language Models, Generative AI, AI Platforms, Information Technology, RSA Archer Platform, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** September 26, 2026 - **Apply:** https://www.jofdav.com/jobs/59880494-vice-president-cybersecurity-risk-compliance-deputy-ciso ## About the Role * 12+ years in cybersecurity, including 5+ years in a senior leadership role, owning strategy, architecture, risk, and a team. * Experience operating as a deputy or right hand to a CISO or equivalent security executive, including acting with delegated authority in their absence. * Demonstrated experience securing SaaS, cloud, and AI/LLM platforms at enterprise scale. * Direct ownership of an enterprise technology risk management program, including risk registers, risk quantification, and executive/board-level risk reporting. * Working knowledge of major compliance frameworks (SOC 2, ISO 27001, GDPR); experience with China-specific frameworks (MLPS/ICP) a strong plus * Hands-on experience with modern threat defense tooling, zero-trust architecture, and identity management * Experience owning a security engineering practice, including secure architecture guidance for a core platform and a penetration testing program through remediation. * A track record of balancing security rigor with delivery speed in agile, DevOps, or CI/CD * Bachelor's degree in computer science, Information Security, or related field; CISSP, CISM, or equivalent certification preferred Preferred qualifications * Direct experience securing generative AI or LLM-based products, including runtime defense and agentic system monitoring. * Experience in a multinational, research, or information-services business * Experience designing a governance model that pre-clears risk categories rather than reviewing every project individually. * Exposure to global regulatory environments, including operating in or adjacent to the Chinese market. * Experience with GRC platforms and leading external audit engagements through to clean opinions ## Description IDC's CIO organization is shifting from project-by-project security review to a pre-cleared, guardrail-based model so that new technology - including AI pilots - can ship in days instead of months. This role owns that shift: building the security architecture, controls, and governance that let the business move fast without moving recklessly., The VP, Cybersecurity, Risk & Compliance serves as Deputy CISO, leading enterprise security strategy, architecture, and operations for IDC day to day and standing in for the CISO on internal leadership, vendor, and operational matters. The role carries direct accountability for keeping pace with an accelerating delivery model across infrastructure, applications, and AI/automation initiatives. This is a hands-on leadership role: the VP sets the security roadmap, runs the team, and personally removes the friction that slows delivery - replacing per-project security gatekeeping with pre-approved patterns, standing guardrails, and fast, decisive risk calls. What You'll Do Strategy, architecture, and governance * Own the enterprise cybersecurity strategy and multi-year architecture roadmap, aligned to business and AI/automation priorities. * Design and maintain a library of pre-approved security patterns and guardrails so new projects and pilots can launch without a bespoke review cycle. * Sit on and support the AI Governance Council as the security authority, pre-clearing model, data, and vendor patterns rather than gating individual pilots AI and platform security. * Lead security for IDC's AI platforms and pilots - prompt-injection defense, runtime AI protection, agentic SOC coverage, PII detection, and red-team/canary testing. * Partner with the AI & Automation team to build security into the 5-day intake-to-ship pilot lifecycle from day one, not as a late-stage checkpoint. * Own identity and access management, zero-trust architecture, and SSO/SAML standards across the enterprise application portfolio * Security engineering Own the security engineering function, including Quanta Cyber Guidance - the secure-by-design reference architecture and build standards for IDC's Quanta platform - keeping it current as Quanta expands into new markets. * Own the enterprise penetration testing program (internal, external, and third-party engagements) across Quanta and the broader application portfolio, tracking every finding through to verified remediation. * Build and maintain secure coding standards and embedded security tooling (SAST/DAST, dependency and vulnerability scanning) so engineering teams get fast, actionable findings inside their own pipelines Enterprise risk management * Own the enterprise technology risk register, driving risk identification, quantification, and mitigation tracking across infrastructure, applications, and AI initiatives. * Set risk appetite and tolerance thresholds with the CIO and executive leadership, and make the fast, decisive accept/mitigate/escalate calls that keep pre-cleared pilots moving. * Author and maintain enterprise security and risk policies, standards, and control frameworks, ensuring consistent enforcement across a global organization Compliance and audit. * Drive certification and regulatory compliance programs (SOC 2 Type II, ISO 27001, GDPR, and market-specific frameworks such as MLPS/ICP for China operations) on defined timelines. * Own the enterprise audit calendar, serving as the primary liaison to internal and external auditors and ensuring evidence and control documentation are always audit-ready. * Manage vendor security and compliance risk assessments against committed SLAs so third-party review never becomes the delivery bottleneck Security operations. * Own incident response, threat detection, and security logging/monitoring (SIEM, cloud-native logging) across the global estate Leadership and reporting * Serve as Deputy CISO, acting with full authority on the CISO's behalf across day-to-day security, risk, and compliance decisions, and standing in for the CISO in their absence. * Build, lead, and develop a global cybersecurity, risk, and compliance team, including succession planning for key roles. * Partner with the CISO to prepare risk posture, compliance status, and audit program health for the CIO, executive leadership, and Audit Committee, and represent the program directly when the CISO is unavailable. * Partner with Infrastructure, Applications, and Data leadership to embed security and compliance checkpoints directly into CI/CD and rapid deployment pipelines., * A published library of pre-approved security patterns is in active use, measurably reducing time-to-ship for new pilots and applications. * SOC 2 Type II and ISO 27001 programs are on track against agreed timelines with no material findings. * AI pilots ship through the standard lifecycle with security built in from intake, not bolted on before launch. * Vendor risk reviews consistently meet SLA, and the team is recognized as an enabler of delivery rather than a checkpoint. * The enterprise risk register is current and actively used to drive prioritization, with clear owners and mitigation timelines for every open risk