Director OF Information Security

About Cresset

Cresset is a firm built by clients, for clients. As an independent, award-winning multi-family office and private investment firm, we are reimagining the way wealth is experienced. Our purpose is to help ensure that both wealth and life are fully optimized—integrated, intentional, and aligned with each client’s vision of success.

We provide access to the caliber of talent, ideas, and investment opportunities typically available to the largest single-family offices and institutions. Our approach is personalized, entrepreneurial, and client-first.

Proudly owned by our clients and employees, Cresset was built to endure. We are creating a 100+ year firm—one focused on delivering an exceptional experience, not only for the families we serve but for the team that serves them. Recognized by Barron’s among the nation’s top RIA firms, and as one of the industry’s best places to work,* Cresset is guided by long-term relationships, shared success, and a belief that wealth should serve a life well lived.

Job Description

We are seeking an experienced Managing Director, Information Security to lead Cresset's enterprise information security program. This senior technology leadership role is responsible for developing and executing the firm's information security strategy, protecting client and firm information assets, and leading the Information Security team.

Reporting to the Chief Technology Officer, this role partners closely with Technology, Compliance, Legal, HR, and business leaders to strengthen Cresset's security posture while supporting the firm's continued growth and regulatory obligations. The successful candidate combines strong technical expertise with practical leadership and is comfortable balancing security, operational efficiency, and business enablement.

We expect our employees to work in the office three days per week as part of our hybrid work environment.

Key Responsibilities

Security Strategy, Governance & Leadership

• Develop and execute Cresset's multi-year information security roadmap aligned with the firm's technology strategy and business priorities.
• Maintain the firm's Information Security Program, including security policies, standards, and governance processes.
• Assess the current security environment and develop prioritized plans to strengthen the firm's overall security posture.
• Partner with the CTO, Compliance, Legal, HR, and business leaders to identify, assess, and mitigate cybersecurity risks.
• Lead security architecture and technology decisions supporting cloud, endpoint, network, identity, and data protection capabilities.
• Develop and manage the Information Security budget, vendor relationships, and technology investments in partnership with Technology leadership.
• Provide regular reporting on security initiatives, key risks, and program maturity to executive leadership.

Team Leadership

• Lead, mentor, and develop the Information Security organization, including leaders responsible for Identity & Access Management (IAM) and Network Security/Data Protection.
• Foster a collaborative, service-oriented security culture that enables the business while appropriately managing risk.
• Establish clear operational processes, performance expectations, and accountability across the Information Security team.
• Provide coaching and career development for security engineers and analysts.
• Manage relationships with security vendors, managed service providers, and consulting partners.

Identity & Access Management

• Lead the firm's Identity & Access Management (IAM) program, including identity lifecycle management, privileged access management (PAM), single sign-on (SSO), multi-factor authentication (MFA), and identity governance.
• Oversee the evaluation, implementation, and ongoing management of IAM technologies including Okta, SailPoint, CyberArk, Microsoft Entra ID, or similar platforms.
• Ensure effective user provisioning, deprovisioning, access reviews, privileged access controls, and role-based access management.
• Partner with IT, HR, and business leaders to improve onboarding, offboarding, and access governance processes.

Data Protection & Network Security

• Lead the firm's data protection and network security program to safeguard sensitive client and firm information across cloud, web, email, endpoint, and network environments.
• Oversee Data Loss Prevention (DLP) capabilities, including data classification, policy development, monitoring, and continuous optimization.
• Ensure security controls are integrat