Security Director

The Security Director owns a portfolio of security programs and the teams that deliver them - typically a related slice of the security function (for example, security engineering + detection + IAM, or GRC + vendor risk + privacy operations). They report to a VP of Security (or a CISO / VP of Cyber Security and Risk) and are accountable for delivery across that portfolio: the roadmaps land, the teams are healthy and staffed, the budget holds, and the programs advance the risk posture the VP has committed to the business. The distinguishing altitude is that a Director is a leader of leaders. Where a Security Manager runs one team and its execution, the Director manages managers and senior individual contributors, allocates finite headcount and budget across teams, and resolves the cross-team dependencies no single manager can. Where the VP sets strategy, owns the total budget, and carries the board relationship, the Director translates that strategy into program execution and answers for whether it actually ships. The Director rarely does the security work with their own hands; their leverage is roadmap, org design, prioritization, and the quality of the managers they develop. What separates great from average is portfolio judgment and multiplier leadership: deciding which of several competing programs gets the next hire and which waits, developing managers into owners rather than doing their jobs for them, and defending a delivery trade-off to the VP in the language of risk and business outcome - not activity. A great Director makes three teams feel like one aligned program; an average one becomes the bottleneck every decision routes through.