Associate Director, Cybersecurity & IT
Sage Bionetworks · Remote
About Us
Sage Bionetworks is a nonprofit biomedical research and technology organization that advances human health through open science and collaborative discovery. We work at the intersection of biomedical science, data, technology, and patient engagement, partnering across academia, industry, philanthropy, and government to build research programs, data resources, and technology that accelerate scientific progress.
Sage brings particular expertise in collaborative research, multimodal biomedical data, responsible data governance, and open source technology. Our Synapse platform serves as a generalist research data repository and is trusted to responsibly steward research data at scale.
The Opportunity
Sage Bionetworks is seeking an Associate Director, Cybersecurity & IT to lead our cybersecurity program and enterprise IT function. This role sets Sage’s cybersecurity strategy and leads the teams responsible for implementing and operating security controls, protecting Sage’s systems and data, identifying and remediating vulnerabilities, responding to security incidents, and providing reliable and secure technology services to our employees.
Sitting at the intersection of Sage’s research mission, technology platforms, and federal security obligations, this leader will bring deep cybersecurity engineering expertise alongside practical IT leadership. We are looking for someone who can strengthen and scale our security capabilities, translate security requirements into effective technical practices and controls, and lead the team responsible for employee technology, access, infrastructure, and IT services.
This role works closely with Sage’s security compliance function. The compliance team is responsible for interpreting applicable security frameworks and requirements, coordinating assessments and audits, and organizing compliance evidence. The cybersecurity team is responsible for implementing and operating security controls, maintaining secure engineering and operational practices, addressing identified risks and vulnerabilities, and producing evidence demonstrating that controls are operating effectively.
This is a chance to make a meaningful impact at the intersection of security, technology, research, and open science, building the capabilities and foundation Sage needs for its next phase of growth.
You'll succeed at Sage if you:
- Have led cybersecurity teams responsible for designing, implementing, and operating security controls in environments subject to rigorous security requirements, including federal security standards.
- Understand frameworks such as FISMA/RMF and NIST well enough to translate security requirements into practical technical controls and engineering priorities.
- Thrive on continuously strengthening and scaling security capabilities as the organization grows, rather than simply maintaining an established program.
- Can explain complex security risks and technical trade-offs in terms a scientist, an engineer, and an executive can each act on, and can maintain high security standards under delivery pressure.
- Bring genuine IT operations experience alongside cybersecurity leadership and are comfortable staying close to infrastructure, identity, endpoint management, security tooling, and day-to-day technology operations.
- Are motivated by mission-driven organizations and know how to build high-impact security and technology capabilities efficiently.
You'll know you're succeeding when:
- Sage’s security controls are implemented effectively, operated consistently, and supported by reliable technical evidence demonstrating that they are functioning as intended.
- Vulnerabilities, security findings, and technical risks are identified, prioritized, and remediated according to defined, risk-based timelines.
- Sage has effective capabilities for detecting, investigating, containing, and recovering from cybersecurity incidents.
- Security practices are integrated into engineering and IT operations, with clear standards, repeatable processes, appropriate automation, and well-defined ownership.
- Product and engineering teams incorporate security requirements early in technology and product decisions, with the cybersecurity team serving as a trusted technical partner.
- Sage’s cybersecurity function is resilient and appropriately staffed, with the skills, tooling, processes, and coverage necessary to protect the organization.
- Sage’s security compliance team receives timely, accurate evidence and technical support needed to demonstrate the effectiveness of Sage’s security controls.
- Employees have a reliable, low-friction technology experience, with timely onboarding and offboarding, appropriate access, responsive IT support, and well-managed software and device lifecycles.
- Leadership and the Board have clear, ongoing visibility into significant cybersecurity risks, incidents, security capabilities, and technology investments.
Note: Please do not upload your resume as your cover letter (required)
Key Responsibilities
Cybersecurity Leadership & Operations
- Set and execute Sage’s cybersecurity strategy and roadmap, establishing priorities, investments, capabilities, and measures of effectiveness based on organizational risk, the threat landscape, and applicable security requirements.
- Lead the design, implementation, operation, and continuous improvement of technical and operational security controls across Sage’s enterprise and technology environments.
- Oversee security operations, including security monitoring, threat detection, vulnerability management, security testing, incident investigation and response, and remediation of identified weaknesses.
- Establish and maintain security engineering and operational practices that reduce risk through secure configuration, automation, monitoring, testing, and repeatable processes.
- Ensure vulnerabilities and security findings are appropriately triaged, assigned, tracked, and remediated according to risk-based timelines.
- Lead Sage’s cybersecurity incident-response capabilities, including preparation, detection, investigation, containment, remediation, recovery, and post-incident improvement.
- Partner with product and engineering teams to identify security risks and incorporate appropriate security controls and practices into Sage’s platforms, infrastructure, and software-development processes.
- Author and maintain the technical security standards, procedures, and documentation that implement Sage’s security policies, along with the operational evidence needed to demonstrate that controls are implemented and operating effectively.
- Partner closely with Sage’s security compliance function to translate applicable framework and control requirements into technical implementations and provide evidence needed for assessments and audits.
- Evaluate and manage security technologies and services, ensuring that Sage’s security tooling provides effective protection, visibility, and operational efficiency.
- Provide technical security expertise in the evaluation, onboarding, and ongoing management of critical technology and cloud vendors.
- Represent Sage in external technical security and IT conversations as appropriate.
IT Operations & Employee Technology
- Lead day-to-day IT operations and employee technology services, ensuring employees have reliable and secure access to the systems, devices, software, and support they need throughout the employee lifecycle.
- Oversee identity and access management, including provisioning and deprovisioning, authentication and authorization controls, privileged access, and periodic access reviews.
- Oversee endpoint and asset management, enterprise SaaS administration and licensing, and associated technology vendor relationships.
- Establish and enforce technical IT and security standards, including device configuration, endpoint protection, identity and access controls, software management, and acceptable technolo