Associate Director, Cybersecurity & IT

About Us Sage Bionetworks is a nonprofit biomedical research and technology organization that advances human health through open science and collaborative discovery. We work at the intersection of biomedical science, data, technology, and patient engagement, partnering across academia, industry, philanthropy, and government to build research programs, data resources, and technology that accelerate scientific progress. Sage brings particular expertise in collaborative research, multimodal biomedical data, responsible data governance, and open source technology. Our Synapse platform serves as a generalist research data repository and is trusted to responsibly steward research data at scale. The Opportunity Sage Bionetworks is seeking an Associate Director, Cybersecurity & IT to lead our cybersecurity program and enterprise IT function. This role sets Sage’s cybersecurity strategy and leads the teams responsible for implementing and operating security controls, protecting Sage’s systems and data, identifying and remediating vulnerabilities, responding to security incidents, and providing reliable and secure technology services to our employees. Sitting at the intersection of Sage’s research mission, technology platforms, and federal security obligations, this leader will bring deep cybersecurity engineering expertise alongside practical IT leadership. We are looking for someone who can strengthen and scale our security capabilities, translate security requirements into effective technical practices and controls, and lead the team responsible for employee technology, access, infrastructure, and IT services. This role works closely with Sage’s security compliance function. The compliance team is responsible for interpreting applicable security frameworks and requirements, coordinating assessments and audits, and organizing compliance evidence. The cybersecurity team is responsible for implementing and operating security controls, maintaining secure engineering and operational practices, addressing identified risks and vulnerabilities, and producing evidence demonstrating that controls are operating effectively. This is a chance to make a meaningful impact at the intersection of security, technology, research, and open science, building the capabilities and foundation Sage needs for its next phase of growth. You'll succeed at Sage if you: • Have led cybersecurity teams responsible for designing, implementing, and operating security controls in environments subject to rigorous security requirements, including federal security standards. • Understand frameworks such as FISMA/RMF and NIST well enough to translate security requirements into practical technical controls and engineering priorities. • Thrive on continuously strengthening and scaling security capabilities as the organization grows, rather than simply maintaining an established program. • Can explain complex security risks and technical trade-offs in terms a scientist, an engineer, and an executive can each act on, and can maintain high security standards under delivery pressure. • Bring genuine IT operations experience alongside cybersecurity leadership and are comfortable staying close to infrastructure, identity, endpoint management, security tooling, and day-to-day technology operations. • Are motivated by mission-driven organizations and know how to build high-impact security and technology capabilities efficiently. You'll know you're succeeding when: • Sage’s security controls are implemented effectively, operated consistently, and supported by reliable technical evidence demonstrating that they are functioning as intended. • Vulnerabilities, security findings, and technical risks are identified, prioritized, and remediated according to defined, risk-based