{"id":1294542,"url":"https://alion.io/job/joist-evercommerce-senior-director-information-security","title":"EverCommerce: Senior Director Information Security","company":{"id":2106260,"name":"Joist","domain":"joist.com","url":"https://alion.io/company/joist","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Denver, United States","United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":225000,"max":275000,"currency":"USD","period":"year","gross":null,"usd_annual":275000},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":true,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Amazon ECS","optional":false},{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"Docker","optional":false},{"name":"eBPF","optional":false},{"name":"GitHub","optional":false},{"name":"HIPAA","optional":false},{"name":"Linux","optional":false},{"name":"NIST CSF","optional":false},{"name":"OpenTelemetry","optional":false},{"name":"PCI DSS","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Shift-Left Security","optional":false},{"name":"SIEM","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TruffleHog","optional":false},{"name":"Crowdstrike","optional":true},{"name":"Kubernetes","optional":true},{"name":"Okta","optional":true}],"status":"live","first_seen_at":"2026-09-01T00:00:00Z","employer_posted_date":"2026-09-01","last_verified_at":"2026-10-27T12:27:04Z","board_verified":true,"closed_at":null,"days_open":56,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":56},"description":"EverCommerce (Nasdaq: EVCM) is a leading service commerce platform, providingvertically-tailored, integrated SaaS solutions that help more than745,000 global service-based businesses accelerate growth, streamline operations, and increase retention. Its modern digital and mobile applications create predictable, informed, and convenient experiences between customers and their service professionals. With its EverPro, EverHealth, and EverWell brands specializing in Home, Health, and Wellness service industries, EverCommerce provides end-to-end business management software, embedded payment acceptance, marketing technology, and customer experience applications. Learn more at EverCommerce.com.\nWe are building an extraordinary company and looking for talented, energetic, and motivated people to join our team.You can learn more about ourCompany,Culture and Values here: https://www.evercommerce.com/about-us/careers/\nThis role reports to the Chief Information Security Officer (CISO) and requires a hands-on cybersecurity leader who can balance strategic planning with operational execution, and is responsible for maturing a scalable, business-aligned security program supporting a diverse portfolio of dozens of SaaS products across multiple vertical business units. The Senior Director Information Security partners closely with the multiple groups including Vertical Business Product Development, Legal, Compliance, the People Team, and senior leadership to ensure security enables innovation while effectively managing cyber risk.\nThe ideal candidate is an experienced security leader capable of balancing strategic planning with operational execution in a fast-paced, acquisition-driven SaaS organization.\nCore Responsibilities\n1. Engineering-First Security Architecture & DevSecOps (Shift-Left)\nPlatform Security-as-Code: Partner with Platform Engineering to enforce mandatory security baselines, Terraform modules, and AWS Control Tower account isolation.\n Shift-Left AppSec & Container Security: Embed automated security gates (SAST, DAST, SCA, dependency analysis, and TruffleHog secret scanning) directly into GitHub CI/CD pipelines.\nGolden Container & AMI Approval: Establish signing, scanning, and approval pipelines for the Central Golden Container Registry to eliminate base-image vulnerability drift across production.\nCentral Secrets & Cryptographic Lifecycle: Mandate enterprise-wide AWS Secrets Manager and Vault architectures, enforcing automated 60/90-day rotation and eliminating plain-text secrets across staging and production\n2. Incident Response & Cyber Resiliency\n 24x7 Detection & Threat Hunting: Direct the modernization of the Security Operations Center (SOC), optimizing SIEM telemetry (Elastic Cloud / ECS log schemas) and SOAR automation (Torque).\n Zero-Code Infrastructure Observability: Leverage Linux kernel-level telemetry (eBPF and OpenTelemetry collectors) baked into base infrastructure to catch unauthorized API access, anomalous database queries, and lateral movement out-of-process\n Crisis Management & Incident Response: Lead enterprise incident response, digital forensics, root cause analysis (RCA), and executive crisis communications.\n Adversary Emulation & Offensive Security (Red/Purple Teaming): Direct internal and contingent red-team penetration testing across all HIPAA, PCI, and proprietary SaaS platforms, driving cross-team CTF exercises and threat modeling.\n3. Continuous Trust & Automated Compliance (GRC Modernization)\nContinuous Compliance Automation: Transition GRC from point-in-time manual evidence collection to API-driven, continuous control validation supporting SOX 404(b), HIPAA, PCI DSS, NIST CSF, EHNAC, and SEC disclosure requirements.\nCentralized Risk Governance: Maintain an auditable, real-time enterprise Risk Register, eliminating fragmented policy exceptions in email and chat tools.\n Third-Party Risk & Customer Trust: Standardize vendor risk management workflows (Coupa/security assessments) and provide automated security assurance documentation for enterprise customer deals.\n4. Hub-and-Spoke VBU Partnership & Culture\nEmbedded Security Spokes: Deploy and lead dedicated Security Engineering \"Spokes\" who sit directly in Vertical Business Units product sprint planning to eliminate delivery roadblocks upfront.\nSecurity & Cloud Guilds: Foster an engineering mindset across the broader technology team, establishing internal training guilds to upskill engineers in secure coding, automation, and modern cloud operations\n5. Additional core responsibilities\nDevelop multi-year cybersecurity strategic plans and roadmaps.\nAlign security investments with business priorities.\nSupport mergers, acquisitions, and divestitures from a cybersecurity perspective.\nDrive AI and automation across security operations.\nRequired Qualifications & Leadership Profile\n Education: Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Computer Engineering, or a related technical discipline (or equivalent practical experience).\nExperience Level:\n12+ years of progressive leadership with significant focus across multiple information security domains, including cloud security, and software platform security, security strategy, architecture, engineering, controls, testing, vulnerability management, incident response, and cyber resiliency.\n 6+ years of direct people leadership experience leading multi-disciplinary teams (Architecture, SecOps, IR, GRC) in high-growth, public SaaS or enterprise technology companies\nTechnical Depth:Demonstrated hands-on engineering background in AWS cloud infrastructure, Infrastructure-as-Code (Terraform/CloudFormation), and container orchestration (ECS, EKS, Docker).\nProven track record building or modernizing SIEM/SOAR pipelines, automated detection engineering, and incident response operations\nDirect experience designing and executing continuous compliance programs under SOX 404(b), HIPAA, PCI DSS, or SEC reporting frameworks.\n\n Executive & Communication Skills:Exceptional ability to translate complex security risks into clear business metrics (MTTD, MTTR, exposure burn-down) for C-suite executives and Board Audit Committees\n\nStrong collaborative acumen to lead through influence in a decentralized, multi-business unit operating model\nStrong knowledge of or leading enterprise security architecture, building and maturing security GRC programs, and deep knowledge of cyber threat landscapes, attacker tactics, techniques, and procedures (TTPs).\nPreferred Qualifications\nExperience leading security due diligence and post-merger integration for high-volume M&A activity\nDirect experience with modern security tools: Information Asset Inventory systems, SIEM tools, Elastic Cloud, Torq SOAR, CrowdStrike, EDR/MDR/XDR, Okta, Netskope, AWS Secrets Manager, PAM, TruffleHog, and Lumos AI.\nRecognized security and architecture credentials (e.g., CISSP, CISM, CISA, GMON, CCSP, AWS Certified Security Specialty)\nExperience working with SaaS software development and product teams.\nExperience working with distributed and remote team environments.\nLeadership Expectations\nThe Senior Director Information Security is expected to:\nInspire high-performing security teams.\nDevelop future security leaders.\nBuild trusted relationships with multiple levels of leadership and business stakeholders.\nCommunicate complex cybersecurity risks in business terms.\nFoster collaboration across decentralized business units.\nPromote a culture of accountability, innovation, and operational excellence.\nLead through influence in a matrixed organizational environment.\nWhere: This role can be remote or hybrid if within close proximity to an EverCommerce location.\nThe EverCommerce team is distributed globally, with teams in the U.S., Canada, the U.K., Jordan, New Zealand, and Australia. With a widely distributed team, we are used to working remotely across different time zones. This role can be based anywhere in the United States. - if you’re close to one of our offices, we can set you up in-office or you can work 100% remotely.Please note that you must be eligible to work without sponsorship to qualify for this position, and this role may require travel of up to our Corporate Headquarters in Denver, Colorado, or to other office locations around North America.\nBenefits and Perks:\nFlexibility to work where/how you want within your country of employment - in-office, remote, or hybrid\nDay 1 access to a robust health and wellness benefits, including an annual wellness stipend\n401k with up to a 4% match and immediate vesting\nFlexible and generous (FTO) time-off\nEmployee Stock Purchase Program\nCompensation: The target base compensation for this position is between $225,000 - $275,000 USD per year with a variable component included in most US locations. Final offer amounts are determined by multiple factors including location, local market variances, and candidate experience and expertise, and may vary from the amounts listed above.\nEverCommerce is an equal opportunity employer and we value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender identity, sexual orientation, age, marital status, veteran status, or disability status. We look forward to reviewing your credentials and getting to know more about your experience!","description_format":"text","description_chars":9311,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["401k plan"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Payment Processing & Gateways","Information Security","Field Service Management Software"],"lifecycle":[{"event":"open","at":"2026-09-26T08:53:58Z"}],"visa":[],"liveness":{"score":25,"band":"fade","label":"Fading","p_open":1,"p_active":0.726,"p_room":0.35,"age_days":56,"expected_fill_days":17,"reasons":["conf:3","velocity","win:tail"],"computed_at":"2026-10-27T05:46:45Z"},"pay":{"stated_usd_annual":275000,"is_top_pay":true},"html_url":"https://alion.io/job/joist-evercommerce-senior-director-information-security","json_url":"https://alion.io/job/joist-evercommerce-senior-director-information-security.json","meta":{"generated_at":"2026-10-27T22:10:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13741,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2106260},"rest":"https://alion.io/mcp/rest/get_company?id=2106260"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fjoist-evercommerce-senior-director-information-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fjoist-evercommerce-senior-director-information-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fjoist-evercommerce-senior-director-information-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/joist-evercommerce-senior-director-information-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fjoist-evercommerce-senior-director-information-security"}]}