Associate Director of Cybersecurity

It's a great feeling to work for a company that does so much good for others around the world!

Academic Req

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent relevant experience may be considered in lieu of a degree.

Preferred Qualifications

CISSP, CISM, CRISC, GCIH, GCIA, Security+, CEH, CCSP, Microsoft SC-100, SC-200, AZ-500, AWS Security Specialty, or equivalent.

Work Experience: 5+ years in cybersecurity or information protection

Position Summary:

First Day Foundation is seeking an experienced, hands-on Associate Director of Cyber Security to help lead and mature cybersecurity operations across First Day Foundation and its affiliated organizations.

This role will partner closely with the Director of Cyber Security, IT leadership, and business stakeholders to protect a diverse, mission-driven environment while enabling the organization to operate efficiently and securely.

The Associate Director will provide operational leadership across security monitoring, incident response, vulnerability management, identity security, security engineering, and compliance initiatives. This person must be comfortable moving between strategic planning, technical investigation, and clear communication with both technical and non-technical leaders.

This role serves as the operational bridge between executive priorities and the Cyber Security team’s daily execution: translating direction into clear priorities, assigning accountable owners, tracking delivery, and escalating decisions or unresolved risks. The Associate Director is the Director of Cyber Security’s trusted backup and right-hand partner, able to lead with sound judgment when the Director is unavailable.

The role translates CISO priorities into execution through the Cyber Security Manager and provides the CISO visibility into material risks and progress.

Essential Functions and Measurable Deliverables:

• Support the Director of Cyber Security in developing, implementing, and maintaining the organization’s cybersecurity strategy, roadmap, policies, standards, and operating procedures.
• Lead day-to-day security operations across First Day Foundation and affiliated organizations, including alert triage, investigations, incident coordination, and follow-through on remediation actions.
• Convert executive priorities and risk decisions into an actionable operating plan; establish clear ownership, track commitments and remediation to completion, and elevate blockers, tradeoffs, and unresolved risk decisions to the Director of Cyber Security.
• Oversee and help optimize security platforms, including endpoint detection and response, identity protection, SIEM/log management, Microsoft 365 security, cloud security, email security, and data protection controls.
• Own the operational relationship with CrowdStrike Falcon Complete and related CrowdStrike services. Assess sensor and identity coverage, alert quality, escalation effectiveness, and investigative findings; coordinate response with IT and affiliate teams; and ensure agreed remediation actions are assigned, tracked, and resolved.
• Manage and mature the incident response program, including incident documentation, containment coordination, lessons learned, tabletop exercises, and executive reporting.
• Drive vulnerability and exposure management efforts by coordinating risk-based remediation with infrastructure, cloud, application, and affiliate IT teams.
• Partner with Identity and Access Management teams to strengthen MFA, Conditional Access, privileged access, account lifecycle processes, and third-party access controls.
• Help manage security logging and detection engineering, including onboarding priority data sources, tuning detections, reducing false positives, and improving investigation workflows.
• Establish and operate practical AI security governance for employee-built agents, automations, and AI-enabled workflows. Maintain visibility into what is being built, the data and systems each solution can access, actions it can take, and the accountable business and technical owner.
• Support third-party risk assessments, vendor security reviews, contract security requirements, and ongoing vendor-risk tracking.
• Assist with compliance and assurance initiatives, including SOC 2, NIST Cybersecurity Framework, HIPAA, FTC Safeguards Rule, and other applicable regulatory or contractual obligations.
• Develop meaningful security metrics and reports for leadership, including incident trends, vulnerability remediation, endpoint coverage, phishing performance, identity risk, and program maturity.
• Coordinate with affiliate IT leaders to ensure security standards are implemented consistently while accounting for operational needs and local business requirements.
• Build hands-on technical understanding of how AI agents, connectors, automations, and integrations are designed and deployed so the Cyber Security team can test realistic risks firsthand. Partner with Data Governance, application teams, and business owners to implement workable guardrails for identity, permissions, data handling, logging, human oversight, and change management.
• Help lead security awareness and phishing-training programs for employees and contractors.
• Serve as an escalation point for complex technical security issues and provide mentorship, guidance, and quality assurance for security analysts and engineers.
• Participate in an on-call or incident-response rotation as needed.

Skills and Abilities Required:

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent relevant experience may be considered in lieu of a degree.
• Five or more years of progressive experience in cybersecurity, IT security, systems administration, cloud security, or a related technical discipline.
• Three or more years of experience leading security operations, security projects, technical teams, or cross-functional security initiatives.
• Strong experience with security operations and incident response, including detection triage, investigation, containment, recovery, and post-incident review.
• Demonstrated ability to turn security strategy into operational execution by setting priorities, assigning ownership, tracking actions, communicating status, and escalating unresolved decisions or risks.
• Working knowledge of Microsoft security technologies, including Microsoft 365, Entra ID, Intune, Defender, Conditional Access, and Purview.
• Experience with EDR/XDR, SIEM, vulnerability management, email security, network security, and cloud platforms such as AWS and Azure.
• Experience with, or strong aptitude to rapidly develop proficiency in, managed detection and response operations, security-vendor management, endpoint and identity coverage assessment, and remediation coordination across decentralized teams.
• Familiarity with common security frameworks and regulatory requirements, including NIST CSF, CIS Controls, SOC 2, HIPAA, and FTC Safeguards Rule.
• Ability to translate technical risks into practical business impact and clear recommendations for executive leadership.
• Strong written, verbal, organizational, and stakeholder-management skills.
• Ability to work independently, manage competing priorities, and remain composed during security incidents.

Aptitude in emerging AI-agent and automation architectures, including identity, permissions, integrations, data flows, logging, and human-in-the-loop controls.

Skills and Abilities Preferred:

• Master’s degree in a related field.
• Relevant certifications such as CISSP, CISM, CRISC, GCIH, GCIA, Security+, CEH, CCSP, Microsoft SC-100, SC-200, AZ-500, AWS Security Specialty, or equivalent.
• Experience supporting a nonprofit, healthcare, human-services, multi-entity, or similarly regulated environment.
• Experience operating CrowdStrike Falcon Complete, Falcon Identity, Exposure Management, and/or CrowdStrike Next-Gen SIEM/LogScale, including vendor coordination, coverage assessment, alert and case review, and remediation tracking; experience with Microsoft Defender, Microsoft Purview, Fortinet, Salesforce, Workday, or similar enterprise platforms.
• Experience building or improving a cybersecurity program in a distributed or multi-affiliate organization.
• Experience managing MSSP, MDR, incident-response, or other security-vendor relationships.
• Experience assessing or governing AI-enabled applications, agents, copilots, automations, APIs, or low-code integrations in an enterprise environment.

Core Competencies:

• Sound judgment and a risk-based approach to decision-making.
• Strong technical curiosity and ability to investigate complex issues.
• Practical curiosity about AI agents and automation, with the ability to learn how they are built and connected before designing proportionate security guardrails.
• Ability to balance security requirements with mission, operational, and user needs.
• Clear ownership, follow-through, and attention to detail.
• Operational leadership that turns direction into prioritized, accountable execution and surfaces decisions at the right level and time.
• Collaborative leadership style with the ability to influence without relying solely on direct authority.
• High integrity and discretion when handling sensitive information.

English (United States)

If you like to work with people that believe they can make a difference in the world, this is the company for you!

EEO Statement

In accordance with Title VII of the Civil Rights Act of 1964 and other applicable federal and state laws (e.g., the Age Discrimination in Employment Act (ADEA), and the Americans with Disabilities Act (ADA), it is our policy to provide equal employment opportunity and treat all employees equally regardless of race, religion, national origin, color, sex, or any other classification made unlawful or prohibited by federal, state and/or local laws, such as age, citizenship status, veteran or military status, or disability.

This policy applies to all terms and conditions of employment, including hiring, promotion, demotion, compensation, training, working conditions, transfer, job assignments, benefits, layoff, and termination.

Applicants must be authorized to work for ANY employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

#LI-Information Technology

#LI-Mid-Senior level

#LI-Full-time