Information Security and Systems Lead (Associate Director)

About the role

We are seeking an Information Security and Systems Lead (Associate Director) to own the end‑to‑end security and enterprise systems agenda for a remote‑first, globally distributed non‑profit. Reporting to the executive team, you will lead a small group of specialists, external partners and fractional resources across multiple regions.

Key responsibilities

• Define and execute a multi‑year enterprise systems strategy, including selection and implementation of CRMs, ERPs and related platforms.
• Own architecture, integration decisions and the master data model that connects all systems.
• Manage external implementation partners, negotiate contracts and ensure delivery accountability.
• Lead annual budgeting and financial planning for organisational systems, balancing non‑profit constraints.
• Champion change management and adoption across regions to drive behavioural change.
• Identify and eliminate bottlenecks, reduce shadow IT and ensure reliable system operation across time zones.
• Develop and maintain the information security strategy aligned with recognised frameworks.
• Implement security and privacy controls, coordinate the Information Security Steering Committee and support enterprise risk management.
• Own incident response planning, lead coordination during incidents and drive post‑incident remediation.
• Commission penetration tests, vulnerability assessments and audits, and manage remediation efforts.

Required profile

• Proven experience leading both information security and enterprise systems programmes in a global organisation.
• Comfortable acting as the senior technical voice to executive leadership.
• Experience managing small teams, external vendors and cross‑functional stakeholders.
• Ability to work effectively in a remote‑first, multi‑continental environment.

Required skills

• Enterprise Resource Planning (ERP) systems
• Customer Relationship Management (CRM) systems
• Information security frameworks (e.g., ISO 27001, NIST)
• Incident response planning
• Penetration testing and vulnerability assessment
• Security governance and privacy controls
• Data integration and master data management