Director of Cyber Security

We are looking for a Director of Cyber Security. The Director of Cyber Security is the senior technical leader in EZCORP's CISO organization. The role is accountable for the security tooling and architecture protecting our U.S. store estate, Latin America operations, and US Corporate Support Center. This is a hands-on leadership role: the Director leads and develops a technical team while remaining the deepest technical authority in the function. The role owns the relationship with EZCORP's managed security services provider, holds Tier 2/3 escalation authority for security incidents, and partners with IT GRC on the technical controls behind PCI DSS Level 1 and GLBA.
Why You Will Love Working with Us
Competitive salaries that recognize the expertise you bring
A fully remote role that gives you the freedom to work where you do your best work
A full benefits package to support your well‑being and peace of mind
PTO and company-paid holidays to help you plan time away and maintain balance
A great employee discount at all EZCORP stores — there are always fun finds waiting
Your Role at a Glance
Lead, mentor, and develop a team of security engineers responsible for endpoint security, detection and monitoring, and vulnerability management engineering.
Serve as the senior technical authority across the team's tool domains — EDR, SIEM, WAF, vulnerability management, email security, and security awareness platforms — setting architecture direction and personally leading resolution of the most complex technical problems.
Own the strategic relationship with EZCORP's managed security services provider (MSSP), including SLAs, escalation procedures, contract performance, and renewal.
Act as the Tier 2/3 escalation point for security incidents raised by the MSSP, providing decision authority on containment, access revocation, and asset-criticality judgment calls.
Provide the primary technical interface between security engineering and the IT GRC team, ensuring technical controls required for PCI DSS Level 1, GLBA, NIST CSF 2.0, and other applicable frameworks are designed, implemented, evidenced, and maintained.
Define security architecture standards for network segmentation, system hardening baselines, and identity and access boundaries, partnering with the Networking and IAM teams that operate those controls.
Lead cardholder data environment (CDE) scope definition and scope-reduction initiatives across the U.S. store estate and Latin America payment architectures, in coordination with IT GRC, Networking, and Treasury.
Develop and continuously refine the security engineering roadmap and technical standards in alignment with the evolving threat landscape and EZCORP's business risk tolerance.
Define OKRs, metrics, and scorecards for the security engineering function and report on team health and risk posture to the CISO and executive leadership.
Partner with application development and infrastructure teams to identify and remediate application- and infrastructure-level vulnerabilities within defined remediation SLAs.
Ensure security requirements are embedded in the design and deployment of new store, cloud, and AI-enabled technologies in support of EZCORP's AI Acceptable Use Policy and AI governance program.
Own workforce planning for the function, including team development, future headcount growth, and maintenance of current documentation covering tool ownership, backup coverage, and operational runbooks.
Track developments in the digital business and threat environment and ensure they are reflected in security strategy and architecture.
Contribute to development of the annual security budget and own tool and vendor spend within the security engineering portfolio.
Support the CISO in maintaining enterprise security policies and standards, including the End User Security Policy and AI Acceptable Use Policy, and provide the technical basis for control requirements.
Represent security engineering as the technical authority during PCI DSS Level 1 Report on Compliance (RoC) assessments, internal audit reviews, and external assessor engagements, alongside the IT GRC team.
Contribute technical risk analysis and remediation options to enterprise risk acceptance and exception decisions.
Participate in an on-call rotation for MSSP escalations and security incident response.
What You Bring to the Role
Bachelor’s degree in computer science, information systems, cybersecurity, or a related field; equivalent professional experience will be considered.
10+ years of progressive information security experience, including 4+ years leading and developing technical teams.
Demonstrated hands-on engineering depth in at least four of the following: EDR, SIEM, WAF, vulnerability management, email security, cloud security, identity security.
Experience managing a third-party MSSP or equivalent outsourced security operations relationship, including SLA, escalation, and contract performance management.
Experience designing, implementing, and evidencing technical controls for a regulated compliance framework (PCI DSS, GLBA, SOX, NIST CSF, or similar).
Experience serving as senior escalation authority during active security incidents, including containment decision-making.
Proven ability to present security risk and remediation plans to executive leadership.
CISSP, CISM, or equivalent senior security certification.
Preferred
Experience with the Microsoft security stack, including Defender for Endpoint, Sentinel, Defender for Cloud Apps, Purview, and Entra ID.
Experience in retail, consumer financial services, or a geographically distributed multi-site store environment.
Working Spanish proficiency or prior experience supporting Latin America operations.

Work arrangement
No