Fractional CISO – Remote Workforce Security

Overview

The company is transitioning to a fully remote model with employees working across multiple locations. Existing workforce security practices have been handled informally, and the organization needs a dedicated leader to establish a comprehensive internal security program.

The security leader will take ownership of building and running the program, covering devices, access, network and email protections, policies, vendors, and training. The role will document existing practices, partner with HR on employee onboarding and offboarding, and work with department leaders across business and technical teams to improve how employees are onboarded, protected, and supported.

Responsibilities

• Capture security knowledge from company leadership and document existing practices.
• Audit device, access, network, and email security across departments.
• Conduct reviews with department leaders and, where needed, individual employees.
• Design and document remote-work security policies covering device use, access, network protections, email, and travel.
• Define a standard network access model and implement role-based access separation between departments.
• Protect sensitive information for employees who travel and safeguard financial data.
• Select and manage third-party providers for device procurement, configuration, and logistics.
• Build device onboarding and offboarding processes with HR, including equipment return.
• Review engineering security practices, including code storage, deployment, and use of personal devices.
• Evaluate and procure security vendors, such as providers of email protection and network access services.
• Communicate the security strategy across the organization and manage resistance to change.
• Deliver security training during onboarding, run recurring workshops, and provide ongoing support after rollout.

Qualifications

• Experience as a CISO or in a role reporting directly to one.
• Background in security operations or operational security within internal, corporate environments.
• Proven experience securing fully remote teams across multiple locations.
• Experience designing security policies for devices, access management, network protections, and email.
• Experience with onboarding and offboarding from a security perspective.
• Experience evaluating and managing third-party security, IT, and logistics vendors.
• Experience working with engineering teams on secure development and deployment.
• Ability to own and drive a security program independently.

Nice to have

• Experience procuring hardware and software for multi-region rollouts.
• Familiarity with regional device and IT service providers.