Director or Sr. Director, Information Security

Who we are:

Kymera is a clinical-stage biotechnology company pioneering the field of targeted protein degradation (TPD) to develop medicines that address critical health problems and have the potential to dramatically improve patients’ lives. Kymera is deploying TPD to address disease targets and pathways inaccessible with conventional therapeutics. Having advanced the first degrader into the clinic for immunological diseases, Kymera is focused on building an industry-leading pipeline of oral small molecule degraders to provide a new generation of convenient, highly effective therapies for patients with these conditions. Founded in 2016, Kymera has been recognized as one of Boston’s top workplaces for the past several years. For more information about our science, pipeline and people, please visit www.kymeratx.com or follow us on X (formerly Twitter) or LinkedIn. 

How we work:

• PIONEER: We are courageous, resilient and rigorous in our mission to improve patients’ lives through our revolutionary degrader medicines.
• COLLABORATE: We value trust + transparency from everyone. Our goals are shared, our decisions data-driven and our camaraderie genuine.
• BELONG: We recognize our differences, inviting curiosity and inclusivity, so that our people are valued, seen, and heard.

How you’ll make an impact:

As our Director / Senior Director of Information Security, you will lead Kymera’s enterprise information security program across a true hybrid environment that includes both on-premises infrastructure and cloud-based platforms. This role combines strategic leadership with hands-on security engineering, ensuring that security controls are thoughtfully designed, effectively implemented, and reliably operated. 
You will be accountable for security strategy, governance, engineering, and operations—protecting Kymera’s intellectual property and data while enabling secure, productive science. This is a highly visible leadership role partnering closely with IT and cross-functional teams to deliver pragmatic, scalable security solutions. 

In this role, you will: 

• Own and evolve Kymera’s information security strategy, policies, and roadmap across hybrid on-prem and cloud environments.
• Serve as the technical authority for security architecture and engineering decisions, guiding how controls are designed, implemented, and integrated across the environment.
• Lead security operations in partnership with an external SOC, including hands-on involvement in incident response, investigation, and post-incident improvements across hybrid systems.
• Be accountable for firewall and network security architecture, including segmentation, secure connectivity, and rule governance supporting on-prem systems and cloud workloads, in partnership with a managed service provider.
• Design, implement, and operate core security controls across identity, endpoints, networks, and cloud platforms, while ensuring operational sustainability.
• Partner with IT and business stakeholders to embed security engineering into solution design and delivery, enabling R&D productivity without compromising security.
• Lead enterprise security risk assessments and third-party risk management across on-prem, cloud, and SaaS environments.
• Partner with Legal, Compliance, Finance, and Quality teams to support audits, assessments, and security reviews.
• Act as a trusted security advisor to senior leadership and provide clear, risk-based cybersecurity reporting with visibility to the Audit Committee of the Board of Directors. 

Skills and experience you’ll bring:

• 10+ years of progressive experience in information security, including ownership of an enterprise security program in a hybrid on-prem and cloud environment. 
• Extensive hands-on experience in security engineering, including designing, implementing, and operating security controls across identity, network, endpoint, and cloud domains.
• Demonstrated experience securing hybrid architectures, not just selecting tools or managing vendors.
• Experience leading security governance, risk management, and operational security while remaining deeply engaged in technical decision-making.
• Proven experience partnering with a managed SOC or MDR provider, including hands-on involvement in incident response across hybrid systems.
• Strong understanding of security operations, monitoring, and response across on-prem sys