{"id":1481848,"url":"https://alion.io/job/sagebionetworks-com-associate-director-cybersecurity-it","title":"Associate Director, Cybersecurity & IT","company":{"id":686542,"name":"Sage Bionetworks","domain":"sagebionetworks.com","url":"https://alion.io/company/sagebionetworks","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"head","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":140000,"max":180000,"currency":"USD","period":"year","gross":null,"usd_annual":180000},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"FedRAMP","optional":false},{"name":"Computer Use","optional":true},{"name":"Multimodal AI","optional":true}],"status":"closed","first_seen_at":"2026-09-29T19:51:12Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-21T19:46:00Z","board_verified":false,"closed_at":"2026-10-21T19:46:00Z","days_open":21,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":21},"description":"About Us\nSage Bionetworks is a nonprofit biomedical research and technology organization that advances human health through open science and collaborative discovery. We work at the intersection of biomedical science, data, technology, and patient engagement, partnering across academia, industry, philanthropy, and government to build research programs, data resources, and technology that accelerate scientific progress.\nSage brings particular expertise in collaborative research, multimodal biomedical data, responsible data governance, and open source technology. Our Synapse platform serves as a generalist research data repository and is trusted to responsibly steward research data at scale.\nThe Opportunity\nSage Bionetworks is seeking an Associate Director, Cybersecurity & IT to lead our cybersecurity program and enterprise IT function. This role sets Sage’s cybersecurity strategy and leads the teams responsible for implementing and operating security controls, protecting Sage’s systems and data, identifying and remediating vulnerabilities, responding to security incidents, and providing reliable and secure technology services to our employees.\nSitting at the intersection of Sage’s research mission, technology platforms, and federal security obligations, this leader will bring deep cybersecurity engineering expertise alongside practical IT leadership. We are looking for someone who can strengthen and scale our security capabilities, translate security requirements into effective technical practices and controls, and lead the team responsible for employee technology, access, infrastructure, and IT services.\nThis role works closely with Sage’s security compliance function. The compliance team is responsible for interpreting applicable security frameworks and requirements, coordinating assessments and audits, and organizing compliance evidence. The cybersecurity team is responsible for implementing and operating security controls, maintaining secure engineering and operational practices, addressing identified risks and vulnerabilities, and producing evidence demonstrating that controls are operating effectively.\nThis is a chance to make a meaningful impact at the intersection of security, technology, research, and open science, building the capabilities and foundation Sage needs for its next phase of growth.\nYou'll succeed at Sage if you:\nHave led cybersecurity teams responsible for designing, implementing, and operating security controls in environments subject to rigorous security requirements, including federal security standards.\nUnderstand frameworks such as FISMA/RMF and NIST well enough to translate security requirements into practical technical controls and engineering priorities.\nThrive on continuously strengthening and scaling security capabilities as the organization grows, rather than simply maintaining an established program.\nCan explain complex security risks and technical trade-offs in terms a scientist, an engineer, and an executive can each act on, and can maintain high security standards under delivery pressure.\nBring genuine IT operations experience alongside cybersecurity leadership and are comfortable staying close to infrastructure, identity, endpoint management, security tooling, and day-to-day technology operations.\nAre motivated by mission-driven organizations and know how to build high-impact security and technology capabilities efficiently.\nYou'll know you're succeeding when:\nSage’s security controls are implemented effectively, operated consistently, and supported by reliable technical evidence demonstrating that they are functioning as intended.\nVulnerabilities, security findings, and technical risks are identified, prioritized, and remediated according to defined, risk-based timelines.\nSage has effective capabilities for detecting, investigating, containing, and recovering from cybersecurity incidents.\nSecurity practices are integrated into engineering and IT operations, with clear standards, repeatable processes, appropriate automation, and well-defined ownership.\nProduct and engineering teams incorporate security requirements early in technology and product decisions, with the cybersecurity team serving as a trusted technical partner.\nSage’s cybersecurity function is resilient and appropriately staffed, with the skills, tooling, processes, and coverage necessary to protect the organization.\nSage’s security compliance team receives timely, accurate evidence and technical support needed to demonstrate the effectiveness of Sage’s security controls.\nEmployees have a reliable, low-friction technology experience, with timely onboarding and offboarding, appropriate access, responsive IT support, and well-managed software and device lifecycles.\nLeadership and the Board have clear, ongoing visibility into significant cybersecurity risks, incidents, security capabilities, and technology investments.\nNote: Please do not upload your resume as your cover letter (required)\nKey Responsibilities\nCybersecurity Leadership & Operations\nSet and execute Sage’s cybersecurity strategy and roadmap, establishing priorities, investments, capabilities, and measures of effectiveness based on organizational risk, the threat landscape, and applicable security requirements.\nLead the design, implementation, operation, and continuous improvement of technical and operational security controls across Sage’s enterprise and technology environments.\nOversee security operations, including security monitoring, threat detection, vulnerability management, security testing, incident investigation and response, and remediation of identified weaknesses.\nEstablish and maintain security engineering and operational practices that reduce risk through secure configuration, automation, monitoring, testing, and repeatable processes.\nEnsure vulnerabilities and security findings are appropriately triaged, assigned, tracked, and remediated according to risk-based timelines.\nLead Sage’s cybersecurity incident-response capabilities, including preparation, detection, investigation, containment, remediation, recovery, and post-incident improvement.\nPartner with product and engineering teams to identify security risks and incorporate appropriate security controls and practices into Sage’s platforms, infrastructure, and software-development processes.\nAuthor and maintain the technical security standards, procedures, and documentation that implement Sage’s security policies, along with the operational evidence needed to demonstrate that controls are implemented and operating effectively.\nPartner closely with Sage’s security compliance function to translate applicable framework and control requirements into technical implementations and provide evidence needed for assessments and audits.\nEvaluate and manage security technologies and services, ensuring that Sage’s security tooling provides effective protection, visibility, and operational efficiency.\nProvide technical security expertise in the evaluation, onboarding, and ongoing management of critical technology and cloud vendors.\nRepresent Sage in external technical security and IT conversations as appropriate.\nIT Operations & Employee Technology\nLead day-to-day IT operations and employee technology services, ensuring employees have reliable and secure access to the systems, devices, software, and support they need throughout the employee lifecycle.\nOversee identity and access management, including provisioning and deprovisioning, authentication and authorization controls, privileged access, and periodic access reviews.\nOversee endpoint and asset management, enterprise SaaS administration and licensing, and associated technology vendor relationships.\nEstablish and enforce technical IT and security standards, including device configuration, endpoint protection, identity and access controls, software management, and acceptable technology use.\nOwn the technical implementation, maintenance, and testing of business continuity and disaster recovery capabilities for critical IT systems, in partnership with organizational stakeholders responsible for broader continuity planning.\nOversee help desk operations, establishing service standards and processes that provide employees with reliable, timely technology support.\nCross-Organizational Security Partnership\nPartner with the security compliance team to understand applicable security requirements, implement required controls, remediate technical findings, and produce accurate evidence demonstrating control operation.\nPartner with product and engineering teams to ensure security, identity, access-management, and data-protection requirements are incorporated into platform architecture and the Synapse roadmap.\nWork with organizational risk and governance functions to evaluate technical security risks and implement agreed-upon risk treatments.\nAdvise executive leadership and the Board on cybersecurity threats, technical risk exposure, security capabilities, significant incidents, and investments in clear, actionable terms, supported by meaningful security metrics.\nPeople Leadership\nBuild, lead, and develop Sage’s cybersecurity and IT teams, maintaining appropriate staffing, technical capabilities, operational coverage, and clear accountability.\nEstablish clear ownership for security operations, security engineering, vulnerability management, incident response, identity and access management, and IT operations.\nDevelop team members through clear expectations, coaching, professional development, and opportunities for increased responsibility.\nFoster a culture in which security is treated as an engineering and operational discipline characterized by measurable controls, automation, continuous improvement, and shared accountability.\nQualifications\nEducation\nBachelor’s degree in computer science, information security, or a related field, or equivalent professional experience.\nExperience\n8+ years of progressive experience in cybersecurity, security engineering, security operations, infrastructure security, or related disciplines, including significant security leadership responsibility.\nDemonstrated experience leading teams responsible for implementing and operating security controls in production technology environments.\nStrong working knowledge of security frameworks and standards such as NIST SP 800-53, NIST Cybersecurity Framework, FISMA/RMF, FedRAMP, or comparable frameworks, with demonstrated ability to translate requirements into effective technical controls.\nExperience with core cybersecurity disciplines such as vulnerability management, security monitoring and detection, incident response, identity and access management, endpoint security, cloud security, and security testing.\nExperience establishing repeatable processes for identifying, prioritizing, tracking, and remediating security vulnerabilities and findings.\nExperience responding to and investigating cybersecurity incidents, including coordinating technical response and driving improvements following incidents.\nDemonstrated ability to communicate cybersecurity risk and technical trade-offs to non-technical executives and a Board.\nExperience partnering effectively with security compliance, risk, audit, or governance teams, including providing technical documentation and evidence demonstrating control implementation and effectiveness.\nExperience leading IT operations at an organization of comparable size and complexity, including employee technology services, identity and access management, endpoint management, and enterprise SaaS administration.\nExperience operating effectively in a lean, mission-driven nonprofit, research, or similarly complex environment.\nNice to Have\nExperience implementing and operating security controls in an environment subject to FISMA, FedRAMP, or other federal security requirements.\nExperience shaping security compliance strategy, including supporting an organization through FISMA/RMF, ATO, or FedRAMP authorization and working with ind...","description_format":"text","description_chars":17113,"description_truncated":true,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Flexible schedule","Professional development","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Bioinformatics","Research Institutes"],"lifecycle":[{"event":"open","at":"2026-09-29T21:28:15Z"},{"event":"close","at":"2026-10-21T19:46:00Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1 · green card filings: 2","filings_12m":1,"filings_prev_12m":3,"green_card_filings_12m":2,"median_offered_wage_usd":95833,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":null,"pay":{"stated_usd_annual":180000,"is_top_pay":false},"html_url":"https://alion.io/job/sagebionetworks-com-associate-director-cybersecurity-it","json_url":"https://alion.io/job/sagebionetworks-com-associate-director-cybersecurity-it.json","meta":{"generated_at":"2026-10-22T21:00:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5385,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":686542},"rest":"https://alion.io/mcp/rest/get_company?id=686542"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsagebionetworks-com-associate-director-cybersecurity-it"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsagebionetworks-com-associate-director-cybersecurity-it"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsagebionetworks-com-associate-director-cybersecurity-it"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sagebionetworks-com-associate-director-cybersecurity-it\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsagebionetworks-com-associate-director-cybersecurity-it"}]}