Job Description

Our cybersecurity and information security teams at IDEXX contribute to a more resilient, adaptable, and security-aware enterprise prepared to navigate today’s evolving threat landscape. We have complex, multi-dimensional programs across the organization that support all the technology needed to deliver products and solutions to customers - enabling them to focus on delivering high quality patient care.

As the Director of the Trust Office (Cyber Governance, Risk & Compliance), you will lead the evolution of IDEXX’s Trust Office and help shape how cybersecurity governance, risk management, controls assurance, and customer trust enable business success across a global organization.

This is more than a traditional Governance, Risk & Compliance leadership role. You’ll build upon an established foundation while transforming the organization into a modern, AI-enabled Trust Office that helps the business understand cyber risk, strengthen customer confidence, accelerate decision-making, and continuously improve cybersecurity maturity.

Information Security at IDEXX is focused on enabling innovation while protecting the business, our customers, and the communities we serve. As a member of the Information Security leadership team, you’ll partner closely with technology, legal, privacy, internal audit, product, sales, and business leaders to modernize governance, strengthen trust, and help define the future of cybersecurity at IDEXX.

In this role, you will:

Lead the transformation of the Trust Office

• Lead the evolution of IDEXX’s Trust Office, expanding an established Governance, Risk & Compliance organization into a modern, business-focused security function.
• Develop the long-term strategy, operating model, and roadmap that advances IDEXX’s cybersecurity maturity.
• Build a culture where Governance, Risk & Compliance is viewed as a trusted business partner rather than a traditional audit function.
• Help shape the future vision, capabilities, and organizational direction of the Trust Office.

Modernize cyber risk management

• Build and mature an enterprise cyber risk management program that enables leaders to understand, communicate, and make informed business decisions regarding cyber risk.
• Develop scalable governance processes, enterprise policies, standards, and risk management frameworks aligned with industry best practices including NIST CSF and CIS Controls.
• Modernize how cyber risk is identified, measured, communicated, and incorporated into business decision-making.
• Oversee enterprise risk registers, risk acceptance processes, executive reporting, and ongoing governance activities.

Advance controls assurance and automation

• Lead the development of an enterprise Controls Assurance program focused on validating that security controls are operating effectively—not simply documenting compliance.
• Expand continuous controls monitoring, automated evidence collection, and scalable assurance capabilities.
• Help transform governance operations through AI-enabled workflows, automation, analytics, and continuous monitoring that allow the organization to operate at “machine speed.”
• Develop executive dashboards and meaningful risk metrics that provide leaders with actionable visibility into IDEXX’s security posture.

Strengthen customer trust and compliance

• Lead customer security assessments, security questionnaires, trust center content, external assurance activities, and customer-facing security documentation.
• Partner with Sales, Product, Legal, Privacy, and Information Security teams to ensure cybersecurity enables customer confidence and business growth.
• Oversee compliance activities supporting SOC 2, SOX IT General Controls, GDPR, SEC cybersecurity disclosure requirements, and emerging regulatory obligations.
• Guide external audits, certifications, regulatory readiness activities, and third-party assessments.

Partner across the enterprise

• Build trusted relationships across Information Security, Technology, Product, Legal, Privacy, Internal Audit, Finance, Procurement, and business leadership.
• Translate complex cybersecurity concepts into practical business discussions that influence strategic decision-making.
• Foster collaboration across Governance, Risk, Compliance, and the broader Information Security organization to improve enterprise security maturity.
• Serve as a trusted advisor who helps business leaders understand both security risks and practical paths toward remediation.

Lead and develop an exceptional team

• Lead, coach, and develop an experienced team of Governance, Risk & Compliance professionals while helping shape future organizational capabilities.
• Foster a culture centered on accountability, collaboration, continuous improvement, and proactive partnership.
• Help leaders across the organization understand how Governance, Risk & Compliance can accelerate—not slow—business objectives.

What You Will Need to Succeed...

We’re looking for an experienced cybersecurity leader who combines strategic vision with operational excellence and has successfully transformed Governance, Risk & Compliance organizations into trusted business partners.

Location: Ideally you will be driving distance from our Westbrook, Maine corporate HQ, with the flexible hybrid requirement of only 8 days per month on-site. We are also open to those in NH and MA if you can meet the on-site requirement, or close to it.

Ideally, you have:

• 10-12+ years of progressive leadership experience in cybersecurity, governance, risk management, compliance, assurance, or related disciplines.
• Experience building, transforming, or significantly maturing enterprise Governance, Risk & Compliance or Trust organizations.
• Demonstrated success leading organizational change within complex global enterprises.
• Experience partnering with executive leadership to improve cybersecurity maturity across the organization.
• Exceptional executive communication skills with the ability to translate technical concepts into meaningful business discussions.
• Experience influencing across organizations through partnership rather than authority.
• A collaborative leadership style focused on coaching, relationship-building, and business enablement.
• Experience developing cyber risk management programs, governance frameworks, policy programs, controls assurance, or continuous monitoring capabilities.
• Experience supporting regulatory and compliance frameworks such as NIST CSF, CIS Controls, SOC 2, SOX IT General Controls, GDPR, SEC cybersecurity disclosure requirements, or similar frameworks.
• Experience with GRC platforms such as ServiceNow GRC, Archer, OneTrust, or similar technologies.
• Familiarity with automation, AI-enabled governance, continuous controls monitoring, or risk telemetry is highly desirable.
• BISO (Business Information Security Officer) or similar business-facing cybersecurity leadership experience is a strong plus.
• CISSP, CISM, CRISC, CISA, CGRC, or similar certifications are preferred.

Why IDEXX?