Senior Director, Security - GRC

About Lumen

Lumen connects the world. We are igniting business growth by connecting people, data and applications – quickly, securely, and effortlessly. Together, we are building a culture and company from the people up – committed to teamwork, trust and transparency. People power progress.

We’re looking for top-tier talent and offer the flexibility you need to thrive and deliver lasting impact. Join us as we digitally connect the world and shape the future.

The Role

The Senior Director of Governance and Business Enablement will take on a strategic leadership role, responsible for ensuring effective security governance, risk management, and compliance (GRC) across Lumen while aligning security with business objectives. This individual will spearhead the company’s Cybersecurity Maturity Model Certification (CMMC) program and ensure compliance with evolving regulatory and industry standards. They will oversee a team of professionals committed to upholding security governance frameworks, supporting business operations through effective security practices, and cultivating a culture of security compliance and risk awareness among business leaders.

This role reports to Global Security Services (GSS) within the Security Governance, Risk, Compliance, and Business Enablement organization. It is vital in shaping security strategy, ensuring effective governance, and supporting business objectives within a global security framework. This leadership position acts as a liaison between the business and security teams by advising leadership on information security matters, implementing security policies, and ensuring regulatory compliance, while actively fostering a culture of security awareness throughout the organization.

The Main Responsibilities

• Oversee and manage the organization’s CMMC compliance program, ensuring compliance with federal security requirements and aligning security policies with evolving regulatory landscapes.
• Create, implement, and uphold security governance frameworks that comply with industry best practices and regulatory standards.
• Serve as a strategic partner to business leaders, ensuring that security policies and controls align with business objectives while reducing risks.
• Guide and mentor a team of security professionals responsible for governance, compliance, and business support.
• Make sure to follow the required security standards, such as NIST 800-171, NIST CSF, and other applicable frameworks.
• Work together with internal business units, external partners, and regulatory agencies to strengthen security governance and compliance initiatives.
• Develop and report on essential performance indicators (KPIs) and reporting mechanisms to evaluate the effectiveness of security governance and compliance initiatives.
• Supervise the development of security policies, standards, and procedures that align with corporate goals and industry regulations.
• Advance security education and awareness initiatives to foster a culture of compliance and mindful decision-making regarding risks.
• Collaborate closely with security operations, privacy, IT, and business leaders to advance integrated security strategies and compliance initiatives.
• Act as a point of contact for internal and external audits, ensuring governance programs effectively support regulatory and contractual requirements.
• Identify ways to improve security governance and compliance processes using automation, analytics, and strategic initiatives.

What We Look For in a Candidate

• Bachelor's degree in Cybersecurity, Information Technology, Business, or a related field.
• 15+ years of experience in security, governance, risk management, or compliance, with at least 5 years in a leadership role.
• Strong understanding of CMMC, NIST 800-171, and other compliance frameworks.
• Experience working with government and regulatory agencies on cybersecurity compliance matters.
• Proven ability to build and maintain relationships across business units and leadership teams.
• Strong leadership, communication, and stakeholder engagement skills.
• CISSP, CISM, CRISC, RPA, CCP or CISA certifications are highly desirable.
• Experience in a