Company Description
Indigo is a physical and digital place inspired by and filled with books, ideas, beautifully designed lifestyle products, and the creative people who help make it all happen. We believe in real books, living life fully and generously, being kind to each other and to the environment, and that stories — big and little — connect us. Indigo is our customer's happy place — for joyful moments of discovery and to connect with people who share their passion for reading, their belief in ideas, and their commitment to making the world a better and more beautiful place.
Job Description
The Information Security Lead provides cybersecurity expertise across Security Awareness, Identity and Access Management (IAM), Cloud Security, Security Risk Assessments, and Security Projects. The role works closely with business and IT teams to identify and manage security risks, support the implementation of security controls, and ensure security requirements are considered in new technologies and projects. As a senior member of the Information Security team, the position serves as a trusted advisor, providing guidance and support to help protect the organization while enabling business objectives.
KEY PERFORMANCE METRICS
-
High completion rates for enterprise security awareness training and positive phishing simulation metrics.
-
Successful design, implementation, and management of Identity and Access Management (IAM) controls, including Azure PIM and PAM.
-
Timely completion of security risk assessments for new technologies, applications, and vendors.
-
Strong cloud security posture maintained across Azure and SaaS environments.
-
Successful support of PCI DSS compliance activities and audits.
KEY ACCOUNTABILITIES
Strategic
-
Act as the security representative on business and technology initiatives, serving as a trusted advisor to protect the organization while enabling business objectives.
-
Lead and support cybersecurity projects from planning through implementation, ensuring security requirements are incorporated into project designs and deployments.
-
Coordinate with internal stakeholders, vendors, and consultants to deliver strategic security solutions.
Functional
-
System Inventory: Maintain an accurate and up-to-date inventory of critical information systems and data assets to support risk assessments, compliance audits, and continuous security monitoring.
-
Risk Management: Support the cybersecurity IT risk management framework by identifying, quantifying, and mitigating cybersecurity risks across corporate, retail, and e-commerce environments. Maintain the IT risk register and facilitate data-driven risk decisions to prioritize remediation efforts.
-
Security Awareness: Manage the enterprise security awareness and phishing simulation program. Develop and deliver security awareness campaigns and communications. Monitor training completion and phishing metrics. Support security culture initiatives across the organization.
-
Identity & Access Management (IAM): Support the design and implementation of Identity and Access Management controls. Manage and improve processes related to user access, privileged access, and multi-factor authentication. Lead IAM initiatives, including Azure PIM and Privileged Access Management (PAM) projects. Collaborate with IT teams to strengthen identity governance and access controls. Conduct periodic access reviews of access to critical information systems.
-
Disaster Recovery: Participate in the development, testing, and execution of disaster recovery procedures and business continuity plans to ensure the resilience and availability of critical information assets and systems.
-
Tabletop Exercises: Facilitate cross-functional incident response and disaster recovery tabletop exercises to validate playbooks, evaluate organizational readiness, and identify actionable improvements.
-
Cloud Security: Support the implementation and operation of cloud security controls across Azure and SaaS environments. Review cloud solutions and provide security recommendations. Participate in cloud security assessments and remediation activities. Work with internal teams and service providers to improve cloud security posture.
-
Security Risk Assessments: Conduct security assessments for new technologies, applications, vendors, and business initiatives. Identify security risks and recommend appropriate mitigating controls. Review solution designs and architectures from a security perspective. Support risk management activities for strategic business and IT projects.
-
Security Operations & Incident Response: Support investigation and remediation of security incidents. Participate in incident response activities and lessons learned reviews. Work with managed security providers and IT teams to address security issues. Support continuous improvement of security monitoring and response processes.
-
Compliance Support: Support PCI DSS compliance activities, audits, and assessments. Assist with security documentation, evidence collection, and remediation efforts. Collaborate with governance, risk, and compliance teams on security initiatives.
-
Vendor & Solution Reviews: Participate in vendor security reviews and product evaluations. Support RFPs and selection of security technologies and services. Review vendor security documentation and recommend security requirements.
People
-
Supports the creation and maintenance of a talent succession plan
-
Collaborate with others to drive flexible and iterative solutions, quickly and easily
-
Share technical knowledge with others and actively seek to learn from those more knowledgeable than yourself
-
Help others see the impacts of their efforts and proactively engage other functions to get input
-
Encourage others to freely share their point of view and be open to feedback
-
Understand and follow Indigo's core HR process - staffing, performance management, rewards, and development
-
Has the ability to see the total organization with an integrated perspective
-
Develops positive and productive peer relationships
Cultural
-
Model Indigo’s beliefs and convey a positive image in everything you do
-
Understands/demonstrates in a manner that promotes, and is aligned with, Indigo's Mission, Vision, Beliefs
-
As a leader, hold others accountable in maintaining the integrity of Indigo's culture
-
Celebrate diversity of thought and have an open mindset
-
Take an active role in fostering a culture of continual learning, taking risks without the fear of making mistakes
-
Embrace, champion, and influence change through your team and/or the organization
SCOPE
Reports to: Director, Information Security
Manager once Removed (MOR): VP Enterprise Technology
KEY RELATIONSHIPS
Internal:
-
IT – Enterprise Applications
-
IT – Information Security
-
PMO
-
Digital
-
Finance
-
Supply Chain
-
Commercial Group
-
Creative
-
Consumer Experience
-
Human Resources
-
Retail leadership
External:
-
Approved Vendors
-
External auditors
-
Regulatory bodies
Qualifications
Work Experience / Education / Certifications
-
Bachelor's degree in Computer Science, Information Security, or a related field.
-
5+ years of progressive experience in Information Security, preferably in a
-
A professional certification in the security field (CISSP, CISM, or relevant cloud security certifications like AZ-500) is considered an asset.
-
Strong experience supporting frameworks and regulations (specifically PCI DSS).
-
Proven experience working with cloud environments (Azure preferred) and IAM/PAM solutions.
Competencies / Skills / Attributes
-
Analytical thinker with strong problem-solving capabilities.
-
Strong ability to influence and translate complex technology risks into business terms.
-
Excellent communicator capable of coordinating with cross-functional stakeholders and vendors.
-
Adaptable and capable of managing multiple priorities in a dynamic environment.
