Director of IT Security Infrastructure

About the company

Our client is an established, vertically integrated maker of premium custom home furnishings, supporting customers at every step from design consultation to installation. Their business spans 100+ retail showrooms nationwide, a national e-commerce platform, and their own manufacturing and distribution operation.

The role

As Director of IT Security & Infrastructure, you will own the security posture and network backbone of the entire business. You will lead our Microsoft 365 security stack, run our Splunk-based logging and detection, manage our third-party MDR/SOC partner, and own our SOC 2 and PCI DSS compliance programs. You will also drive the architecture and reliability of a network spanning 100+ locations.

This is a hands-on leadership role. You should be equally comfortable tuning a Defender policy, writing a Splunk search, reviewing a firewall change, reading PHP code during a security review, and presenting a risk roadmap to the executive team. You will partner closely with DevOps on AWS and application security, and help define how the company adopts AI safely.

Microsoft 365 and identity security

• Own the Microsoft 365 E5 security stack end to end: Defender for Endpoint, Office 365, Cloud Apps and Identity; Entra ID Protection; Conditional Access; Purview (DLP, retention, information protection); and Intune.

• Tune detections, policies and baselines to reduce risk without adding friction for the business.

• Track and improve Microsoft Secure Score and drive remediation of identified gaps.

• Own identity security, including privileged access, MFA enforcement, Conditional Access design and lifecycle governance.

Security operations, SIEM and incident response

• Own our Splunk environment: log onboarding, data quality, detection content, dashboards and alerting across endpoints, network, cloud and applications.

• Manage our third-party MDR/SOC partner, including alert quality, response playbooks, escalation paths and quarterly service reviews.

• Serve as the final escalation point for all security incidents and events.

• Lead incident response from detection through containment, eradication, recovery and post-incident review.

• Maintain and test the incident response plan, and report material events to executive leadership.

Compliance, penetration testing and vulnerability management

• Own our SOC 2 compliance program: control design, readiness, continuous monitoring, auditor coordination and evidence collection for Type II reports.

• Support PCI DSS and other compliance obligations, including audit coordination, evidence production and scope reduction.

• Act as the internal lead for external penetration tests: scoping, coordination, findings triage and remediation tracking to closure.

• Own the vulnerability management program across endpoints, servers, network devices, cloud workloads and web applications.

• Own security policies, standards and security awareness training.

Application and cloud security

• Partner with DevOps and engineering on the security of our AWS environment and our PHP-based e-commerce and internal applications.

• Guide secure coding practices and review application code and architecture for common web vulnerabilities (OWASP Top 10).

• Advise on IAM, VPC design, security groups, WAF, secrets management, logging and encryption.

• Embed security into CI/CD and infrastructure-as-code: SAST/DAST, dependency and container scanning, and policy-as-code.

• Represent security in design discussions without becoming a bottleneck.

Network infrastructure

• Manage and evolve the network across our retail showrooms, corporate offices and manufacturing facilities.

• Oversee firewalls, switching, wireless, SD-WAN, VPN, segmentation and remote access.

• Partner with the IT Operations Lead on design standards, capacity, resiliency and lifecycle planning.

• Make sure monitoring, alerting, on-call coordination and documentation are in place and actively maintained.

AI security

• Define and enforce the security framework for AI adoption, including approved tools, data handling boundaries and acceptable use.

• Evaluate the security of AI vendors, models and agents, covering risks such as prompt injection, data leakage, supply chain risk and unmanaged agent access.

• Partner with the AI Advisory Council to keep governance practical and aligned with how the business uses these tools.

• Detect shadow AI usage and bring it into a managed path.

Leadership, budget and vendors

• Build and manage the security and network infrastructure budget, including forecasting, renewals and multi-year planning.

• Manage vendor relationships, contract negotiation and license optimization across the security and network portfolio.

• Mentor technical staff and collaborate with IT Operations, Business Systems and Production Systems leaders.

• Report on security posture, risk, compliance status and KPIs to executive leadership and the AI Advisory Council.

Qualifications

• Bachelor's degree in IT, Computer Science, Cybersecurity or a related field, or equivalent experience.

• 8+ years in IT security and infrastructure, including 3+ years leading a security team.

• Deep, hands-on expertise in Microsoft 365 security (Defender, Entra ID, Conditional Access, Purview, Intune).

• Hands-on Splunk experience: SPL searches, detections, dashboards and data onboarding.

• Experience overseeing a SOC (in-house or MDR) and leading SOC 2 audits from readiness through report.

• Track record of running external penetration tests and driving findings to remediation.

• Strong network background: firewalls, switching, wireless, SD-WAN, VPN, segmentation and NOC monitoring.

• Working knowledge of AWS security and DevOps (CI/CD, infrastructure-as-code, containers), and the ability to review PHP code against the OWASP Top 10.

• Experience setting AI security and governance practices.

• Scripting skills in PowerShell, Python or similar.

• Budget and vendor management experience, and the ability to explain technical risk to executives.

• Comfortable with tight timelines and on-call rotations.