Associate Director, Information Security

Our commitment to developing our staff is matched only by our commitment to advancing treatment options for patients. At Cytel, we work hard to build successful careers with significant professional growth for our employees and, in turn, make Cytel successful. Cytel is a place where talent, experience, and integrity come together to advance the state of clinical development.

As the world’s leading data-science CRO and pioneer in adaptive trial design, Cytel leverages the power of data to inform clinical strategy at every stage of drug development. From innovative trial design and end-to-end biometrics to real-world evidence, value, and access, we strive to shorten the drug development cycle and increase the probability of success, delivering better patient outcomes through our innovative analytical methods.

We are seeking a hands-on Associate Director, Cybersecurity to lead Cytel’s global cybersecurity program, build and develop a high-performing security team, and drive security strategy across the organization.

Position Overview

Reporting to the Global Head of Information Technology, you will set direction for and lead Cytel’s cybersecurity operations, engineering, and governance across cloud platforms, enterprise applications, endpoints, and infrastructure. You will establish operational objectives and work plans, manage the cybersecurity budget and roadmap, and partner regularly with senior and executive leadership, business functions and customers on security risk. While remaining technically engaged in complex investigations and major incidents, you will build the policies, team and controls that protect clinical research information, customer data and intellectual property across the company.

Why Cytel?

Cytel is a Global CRO providing ground-breaking biostatistical software and services to large pharma and emerging Biotech clients globally. With our patients at the center of all that we do, we help to accelerate the development of drugs and devices that save lives and improve quality of life.

At Cytel, we focus on providing you with a comprehensive and competitive total reward package. In addition, our world-class employee benefits, supportive policies and wellbeing initiatives are tailored to support you and your family at all stages of your career - both now, and into the future.

Cytel Inc. is an Equal Employment / Affirmative Action Employer. Applicants are considered for all positions without regard to race, color, religion, sex, national origin, age, veteran status, disability, sexual orientation, gender identity or expression, or any other characteristics protected by law.

Build, lead, and develop a global cybersecurity team. Set operational objectives and work plans, delegate assignments, manage performance, and plan headcount, succession, and monitoring and response coverage across global time zones.

Define and own the cybersecurity strategy and multi-year roadmap in partnership with the Global Head of Information Technology, aligned to business objectives, customer commitments and regulatory requirements. Establish and manage the cybersecurity budget, schedules, and performance requirements.

Develop, maintain, and enforce company-wide information security policies, standards, and procedures. Lead the information security risk management program, including risk assessments, risk acceptance, and exception processes.

Own the security operations program, including monitoring, threat detection, investigation, and incident response. Serve as incident lead for major security incidents, direct containment, recovery and post-incident reviews, and brief senior and executive leadership, Legal and affected customers as required.

Set direction for the security technology portfolio, including CrowdStrike Falcon, Secureworks Taegis XDR and Microsoft Defender technologies (Defender XDR, Defender Cloud and Defender for Office 365). Manage security vendor and managed service provider relationships, contracts and service levels.

Partner with cloud, infrastructure, and engineering leaders to define security architecture and standards for Azure, Microsoft 365, and Entra ID (Conditional Access, MFA, Privileged Identity Management, identity protection, and Zero Trust), network security (Palo Alto Networks firewalls, GlobalProtect VPN, Cisco Umbrella, segmentation), and privileged access management, including PAM360. Establish security review requirements for new cloud services, SaaS applications, and projects.

Own the vulnerability and exposure management program using Tenable and related tools. Set risk-based remediation standards and timelines with system owners and hold teams accountable for remediation.

Lead security compliance and assurance activities, including internal and external audits, customer security questionnaires and audits, and third-party risk management. Partner with Quality, Legal, Privacy, and Compliance on data protection, GxP, and clinical research requirements.

Drive security automation and the responsible adoption of AI-assisted security capabilities with appropriate governance and human oversight. Guide the team in using PowerShell, Microsoft Graph, and security platform APIs to scale operations.

Lead the security awareness and training program and promote a security-conscious culture across Cytel.

Report cybersecurity posture, key risks, program metrics, and team performance to IT and executive leadership. Influence cross-functional decisions on security risk and gain acceptance for security priorities in sensitive situations.

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent professional experience.

At least 8-10 years of progressive cybersecurity experience and 2 years in a professional management role leading cybersecurity professionals, with proven incident response and enterprise security operations experience.

Demonstrated experience developing security strategies, policies and roadmaps and leading a cybersecurity program in a global organization.

Substantial hands-on expertise in Microsoft Azure, Microsoft 365, and Entra ID, including hybrid Active Directory, Conditional Access, MFA, privileged access, and identity protection.

Experience with enterprise EDR, XDR, SIEM, or managed detection and response platforms; strong skills in log analysis, threat hunting, complex investigations, and incident coordination.

Practical knowledge of vulnerability management, Windows security, network segmentation, secure remote access, cloud security posture, and Zero Trust principles.

Ability to use PowerShell, Microsoft Graph and security platform APIs to improve workflows, integrate tools and reduce manual work.

Proven leadership skills, including building and developing teams, managing budgets and vendors, and setting priorities across competing demands. Ability to influence senior and executive stakeholders and explain risks clearly to technical and nontechnical audiences.

Preferred qualifications

• Cybersecurity program leadership in pharmaceutical, biotechnology, clinical research, healthcare or another regulated global organization.
• Familiarity with NIST CSF, ISO/IEC 27001, SOC 2 control principles, GDPR, GxP, 21 CFR Part 11 and clinical research data integrity expectations.
• Experience with the listed security platforms, Microsoft Purview, Azure Policy, cloud security governance, security orchestration, or AI-assisted security operations. Experience with every listed product is not required.
• CISSP, CISM, relevant Microsoft security, GIAC, CrowdStrike, or Palo Alto Networks certifications are preferred, but not required.