Job Description
The Director, Product
Security Strategy & Enablement is responsible for defining
and operating the Product Security operating model and driving portfolio-level
execution across the department. This leader translates Product Security
strategy into scalable processes, governance, and execution — providing
portfolio-level structure, visibility, and enablement so that work
is prioritized, tracked, and reported consistently. Through standardization,
automation, and AI-enabled capabilities, this role enables predictable delivery
and measurable risk reduction across the program.
This position sits
within a unified Product Security department — established to address
an accelerating, AI-driven threat landscape with enterprise-wide scope across
corporate and hotel-managed environments. Reporting to the Head of Product
Security, this role provides the connective operating discipline across
the Vulnerability Management, Exposure Management, Application Security,
and Remediation and Response functions, ensuring the organization
operates cohesively as a whole rather than as separate
workstreams.
Your Day to Day
style="font-family: "Segoe UI"; font-size: 14px; font-style: normal;
font-weight: 400; line-height: 20px;">
- Set and operationalize
Product Security strategy across people, process, and tooling —
defining the roadmap, setting OKRs, and running planning, prioritization,
and review cadences that translate strategy into
execution. - Establish and operate the Product Security operating
model — including documented processes, decision forums, decision
rights, execution standards, and governance cadences across all
workstreams. - Provide portfolio-level structure and executive
visibility into outcomes — ensuring work across Vulnerability
Management, Exposure Management, Application Security, and Remediation
and Response is prioritized, tracked, and consistently reported through KPIs,
leadership updates, and monthly and quarterly business
reviews. - Own portfolio, budget, and vendor management —
including budget forecasting, the security tool portfolio, renewals, statements
of work, and vendor performance — in partnership with Finance
and Procurement. - Define, enforce, and mature secure SDLC
governance — establishing mandatory security requirements and quality
gates across planning, design, build, release, and operate; governing threat
modeling standards and integration; and managing exceptions, risk acceptances,
compensating controls, and their expirations. - Lead continuous
compliance and audit enablement for product-security-related controls —
coordinating evidence, embedding and monitoring controls, and driving
remediation of audit findings to closure. - Govern large and/or
complex remediation programs — providing program-level structure,
milestones, and escalation paths — and enable scale and efficiency through
process standardization, automation, and AI-enabled capabilities that reduce
manual effort and increase execution consistency. - Lead, coach,
and develop the portfolio, programs, and compliance functions while
partnering with Product Security leaders and cross-functional stakeholders
across ETS, the broader Product and Technology organization, business
information security officers, centers of excellence, Finance, and Procurement
to align strategy, delivery,
and measurement.
What We Need
From You
- 10+ years of progressive security experience
across multiple disciplines, technologies, or processes, including 5+
years establishing organizational structure and managing subordinate
teams. - Substantial leadership-level experience across product
and application security domains — vulnerability management,
application and API security, exposure and attack-surface management,
and remediation operations — with a thorough understanding of the software
and system development lifecycle. - Expert in secure SDLC
governance, security controls, and quality gates, with familiarity
across the full lifecycle tooling ecosystem including SAST, SCA, DAST, secrets
detection, API security, cloud posture, and attack-surface and asset-management
tooling. - Demonstrated experience defining and operating
an operating model — processes, governance, decision forums,
and execution cadence — across multiple functions or workstreams, with strong
portfolio and program management capability from conception through
implementation (milestones, risks, success criteria). - Proven
experience owning budgets, tool portfolios, statements of work, vendor
contracts, and vendor performance, with general knowledge of budgeting,
cost estimation, and scheduling; skilled at defining KPIs and metrics
and driving maturity improvement with strong executive
reporting. - Working knowledge of compliance and audit
enablement for product-security-related controls (e.g., PCI, SOX),
including evidence coordination and control monitoring, and familiarity applying
automation and AI-enabled capabilities to scale security
workflows. - Demonstrated effectiveness in executive presentation,
escalation management, and leadership by influence — able to build
relationships with senior technology and business leaders, adapt to multiple
management styles, and communicate highly technical information clearly across
all levels of the organization. - Proven change agent and team
builder — result-focused, action-oriented, and able to manage changing
priorities in a highly dynamic environment while leading, developing,
and inspiring multi-disciplined
teams.
class="TextRun SCXW233306795 BCX0 NormalTextRun" data-contrast="auto"
xml:lang="EN-US" lang="EN-US" data-ccp-charstyle="Strong"
style="-webkit-tap-highlight-color: transparent; -webkit-user-drag: none;
box-sizing: inherit; font-size: 12pt; font-variant-ligatures: none !important;
line-height: 18px; margin: 0px; padding: 0px; user-select: text;">
style="box-sizing: inherit;">Travel - 10%
class="OutlineElement Ltr SCXW233306795 BCX0"
style="-webkit-tap-highlight-color: transparent; -webkit-text-stroke-width: 0px;
-webkit-user-drag: none; background-color: rgb(255, 255, 255); box-sizing:
inherit; clear: both; color: rgb(0, 0, 0); cursor: text; direction: ltr;
font-family: "Segoe UI", "Segoe UI Web", Arial, Verdana,
sans-serif; font-size: 12px; font-style: normal; font-variant-caps: normal;
font-variant-ligatures: normal; font-weight: 400; letter-spacing: normal;
margin: 0px; orphans: 2; overflow: visible; padding: 0px; position: relative;
text-align: start; text-decoration-color: initial; text-decoration-style:
initial; text-decoration-thickness: initial; text-indent: 0px; text-transform:
none; user-select: text; white-space: normal; widows: 2; word-spacing: 0px;">
class="Paragraph SCXW233306795 BCX0" paraid="1013206517"
paraeid="{514e8b8c-80f2-4068-bc51-700dfe1c28ed}{59}"
style="-webkit-tap-highlight-color: transparent; -webkit-user-drag: none;
background-color: transparent; box-sizing: inherit; color: windowtext;
font-kerning: none; font-style: normal; font-weight: normal; margin: 0px;
overflow-wrap: break-word; padding: 0px; text-align: left; text-indent: 0px;
user-select: text; vertical-align: baseline;">
paraeid="{514e8b8c-80f2-4068-bc51-700dfe1c28ed}{59}"
style="-webkit-tap-highlight-color: transparent; -webkit-user-drag: none;
background-color: transparent; box-sizing: inherit; color: windowtext;
font-kerning: none; font-style: normal; font-weight: normal; margin: 0px;
overflow-wrap: break-word; padding: 0px; text-align: left; text-indent: 0px;
user-select: text; vertical-align: baseline;">
class="TextRun SCXW233306795 BCX0 NormalTextRun" data-contrast="auto"
xml:lang="EN-US" lang="EN-US" data-ccp-charstyle="Strong"
style="-webkit-tap-highlight-color: transparent; -webkit-user-drag: none;
box-sizing: inherit; font-size: 12pt; font-variant-ligatures: none !important;
line-height: 20.85px; margin: 0px; padding: 0px; user-select: text;">
style="box-sizing: inherit;">Location -
lang="EN-US" data-ccp-charstyle="Strong" style="-webkit-tap-highlight-color:
transparent; -webkit-user-drag: none; box-sizing: inherit; font-size: 12pt;
font-variant-ligatures: none !important; font-weight: normal; line-height:
20.85px; margin: 0px; padding: 0px; user-select: text;">Atlanta, GA: Our hybrid
work structure is an expectation of three (3) days a week in office.
This expectation may be adjusted to evolve with the changing needs of
the business.
paraeid="{514e8b8c-80f2-4068-bc51-700dfe1c28ed}{61}"
style="-webkit-tap-highlight-color: transparent; -webkit-user-drag: none;
background-color: rgb(255, 255, 255); box-sizing: inherit; color: windowtext;
font-kerning: none; font-style: normal; font-weight: normal; margin: 0px 0px
15px; overflow-wrap: break-word; padding: 0px; text-align: left; text-indent:
0px; user-select: text; vertical-align: baseline;">
