Director of Enterprise Cybersecurity

Our Commitment to You

At Consumer Cellular, recruiting is human. Every application is reviewed by a real member of our Talent Acquisition team because we believe the people behind the résumé matter just as much as what's on it. 

All official communication from Consumer Cellular will come from a @consumercellular.com email address or through our verified texting platform, which will only be used to schedule interviews. We will never ask for personal and financial information during the recruiting process. If you receive outreach that doesn't match these criteria, please do not engage and feel free to verify directly at talentacquisition@consumercellular.com.  

Position Information
Consumer Cellular is seeking a Director of Enterprise Security to change how security works here. Today it is a central gatekeeper; this role will build it into product delivery and day-to-day operations. You’ll protect Consumer Cellular employees, customers and company data, keep us compliant with regulations and reduce business risk while we move to an AI-first, cloud-native technology stack.

You will lead three areas:

• Security Operations, including Resilience & Recovery
• Governance, Risk & Compliance, including Identity & Access Governance. 
• DevSecOps & Application Security. 

You’ll also move security operations to an automation-first, AI-assisted model. The right candidate makes decisions and delivers measurable risk reduction rather than more analysis. They build a lean team of senior people and make security easy for the business to work with. 

You will need to reside within 50 miles of our Corporate Headquarters in Scottsdale, AZ as this role has the option of hybrid or onsite. 

What You'll Do:

Strategy & Operating Model

• Set and carry out the enterprise security strategy. Replace review boards and approval bottlenecks with secure-by-design practices that keep pace with delivery. 
• Rethink how security work gets done. Use automation, and managed services where they fit, to remove low-value manual work so people can focus on high-value decisions. 
• Build and lead a lean, senior team. Hire and coach managers, and hold them accountable to clear KPIs and SLAs. 
• Own the security budget, forecasts and vendor portfolio, including MDR/MSSP partners. 
• Report security posture, risk and results to executive leadership and the board in business terms.

Security Operations & Resilience

• Lead the move to an automation-first, AI-assisted SOC. AI handles triage, investigation and response under human oversight, and gets more autonomy as audit trails and confidence grow. 
• Set a data-driven baseline for the SOC. Bring alert sources into one operational view, expand SIEM telemetry and report regularly on detection and response. 
• Evaluate and manage MDR/MSSP partners using evidence-based scorecards. 
• Direct incident response, forensics and investigations, and work with Technology Operations on major incidents. 
• Run the threat intelligence and vulnerability management programs, and work with Infrastructure to meet remediation SLAs. 
• Run a resilience program that assumes a breach will happen: cyber recovery and DR exercises, tabletop tests and checks that every managed device meets security requirements. 
• Oversee email security, endpoint security and encryption services.

Identity & Access

• Lead an identity-first program: know who has access to what, enforce least privilege and remove standing privilege. 
• Modernize privileged access and credential management. Consolidate unmanaged credential stores and monitor privileged accounts. 
• Work with HR and Enterprise Systems on role-based access and automated onboarding, role changes and offboarding, with regular access reviews and full audit trails. 

Governance, Risk & Compliance

• Own the compliance programs, including PCI DSS v4.0.1 and telecom obligations such as CPNI, SIM-swap/port-out protections and consumer-protection rules. Keep a map of who is accountable for each control across teams. 
• Move toward continuous compliance, with policy-as-code and automatic detection when systems drift out of compliance. 
• Make security requests easy to track. Vendor risk reviews, exceptions and access requests should go through transparent workflows so the business can see status and owner. 
• Lead third-party and vendor risk management. 
• Run data protection: data classification, encryption, DLP and privacy controls. 
• Run security awareness and training.

DevSecOps & Application Security

• Build the DevSecOps and AppSec function. Start with a validated application inventory and data classification, then add SAST, DAST, software composition analysis (SCA) and secrets scanning to CI/CD pipelines. 
• Give engineering teams secure patterns, guardrails and self-service tools so they own the security of their own services. 
• Work with Infrastructure on cloud security (Azure/AWS), guardrails for infrastructure-as-code and Zero Trust networking. 

AI Security & Governance

• Share ownership of governance for AI agents and tools: agent identity, least-privilege access, audit logging and human approval for high-risk actions. 
• Work with SRE and Platform Engineering on a shared, secure platform for AI agents.