TheCybersecurity Architectplays a critical role in protecting the Wills Group organization and serves as the primarypoint of contact and subject matter expertof enterprise cybersecurity initiatives. This role is responsible for driving the planning, design, implementation, operational management, and continuous improvement of the organization’s cybersecurity program and security architecture.

TheCybersecurity Architectfunctions as the lead technical security resource responsible for advancing cybersecurity maturity across the enterprise through security control design, operational improvements, governance leadership, risk reduction initiatives, and strategic technology recommendations.

This role is responsible for evaluating, recommending, designing, implementing, and maintaining enterprise security technologies, standardsand security controls across infrastructure, endpoint, identity, cloud, network, and operational environments. TheCybersecurity Architectserves as the primary escalation point and technical advisor for cybersecurity operations, vulnerability remediation, security governance, compliance initiatives, and incident response coordination.

TheCybersecurity Architectindependently leads security initiatives involving:

• Vulnerability management strategy and remediation
• Security monitoring and MDR operational coordination
• Penetration testing scope and remediation management
• PCI compliance and governance initiatives
• Security awareness and organizational training
• Vendor and security technology evaluations
• Security roadmap development and operational maturity improvements
• Security standards, baselines, and architectural recommendations

This role requires balancing organizational risk, operational requirements, implementation feasibility, and budget considerations while providing strategic security recommendations to IT leadership and executive stakeholders.

TheCybersecurity Architectwill proactively lead efforts surrounding:

• PCI DSS compliance initiatives
• Cybersecurity audits
• Network andinfrastructure securityimprovements
• Cybersecurity insurance reviews
• External penetration testing coordination
• Disaster recovery and tabletop exercises
• Governance, Risk, and Compliance (GRC) initiatives

TheCybersecurity Architectis expected to operate both strategically and operationally withinourITdepartmentand will serve as the primary driver for advancing the organization’s cybersecurity initiatives and security posture.

How You’ll Make an Impact (Key Accountabilities)

Security Architecture & Engineering

• Design and implement enterprise security solutions and security control frameworks across cloud, endpoint, identity, network, and infrastructure environments.
• Develop security standards, technical baselines, architectural recommendations, and security best practices for enterprise systems and operations.
• Evaluate, recommend, and lead implementation of cybersecurity technologies, vendor solutions, and operational security improvements.
• Drive security maturity improvements through continuous enhancement of tools, processes, monitoring capabilities, and operational controls.
• Develop remediation strategies and lead vulnerability reduction initiatives across the organization.
• Reviews current architectures and systems to ensure consistency and compliance with the organization's guidelines, policies, and standards.
• Defines and develops security requirements using risk assessments, threat modeling, testing, and analysis of existing systems.

Security Operations & Incident Response

• Creates action plans for policy creation and governance, system hardening, monitoring, incident response, disaster recovery, and emerging cybersecurity threats.
• Utilizes security information and event management (SEIM), data loss prevention (DLP), intrusion prevention systems (IPS), and other tools in action plan designs.
• Manage vendors to monitorand detect anomalous or malicious activity within the environment and coordinate incident response and remediation activities as necessary.
• Partnerwith Infrastructure, Field Services, NOC, SOC, MDR, and Managed Service Providers to improve threat monitoring, escalation processes, vulnerability remediation, operational security responseand implementations.
• Serve as the primary point of contact for cybersecurity incidents, security vendors, zero-day threats,and remediation efforts.
• Primary IT liaisonpartneringwithRisk torepresent IT and todevelopcontingency plans and supportbusiness continuity.
• Co-Developdisaster recovery and incident response preparedness activities.

Governance, Risk & Compliance (GRC)

• Lead PCI DSS compliance initiatives and maintain compliance policies in accordance with Level 1 merchant requirements.
• Coordinate external penetration testing engagements, remediation tracking, and security assessment activities.
• Support cybersecurity insurance reviewsand internal/external compliance initiatives.
• Lead Governance, Risk, and Compliance (GRC) activitiesincludingrisk tracking, remediation prioritization, and security policy development.
• Develop and maintain security policies, standards, and procedures aligned with business objectives and regulatory requirements.
• Follow a frameworkfor complianceand report on the progression / maturity.

Security Program Leadership

• Serve as the primary owner and coordinator of enterprise cybersecurity initiatives and operational security improvements.
• Manage security project planning, prioritization, implementation timelines, vendor coordination, and budget-aware security recommendations.
• Lead evaluation and prioritization of security controls, remediation initiatives, and operational risk reduction strategies.
• Compile and present security metrics, KPI reporting, emerging threat analysis, risk summaries, and operational security updates to leadership teams.
• Research emerging cybersecurity threats, industry trends, and evolving technologies to improve organizational security posture.

Training & Organizational Awareness

• Develop and deliver cybersecurity awareness training and educational initiatives across the organization.
• Promote organizational adoption of security best practices and security-first operational behaviors.

What We’re Looking For (Qualifications and Experience)

• Bachelor’s degree in Information Security, Cybersecurity, Information Technology, or equivalent professional experience.
• Minimum 5+ years ofITexperience in infrastructure,security,systems, or related disciplines.
• Experience leading enterprise cybersecurity initiatives and operational security improvements in a small-to-mid-sized organization.
• Experience evaluating, implementing, and managing enterprise security technologies and vendor solutions.
• Experience coordinating vulnerability management, remediation planning, security monitoring, and incident response activities.
• Experience supporting or leading PCI DSS compliance initiatives, penetration testing remediation, and Governance, Risk, and Compliance (GRC) activities.
• Strong understanding of enterprise security architecture principles, security controls, risk management, and operational security practices.
• Experience balancing security priorities, operational requirements, and budget considerations when recommending solutions and improvements.
• Demonstrated analytical, problem-solving, and project leadership skills.

Preferred Technical Experience

Experience with technologies such as:

• Palo Alto Firewalls
• Zscaler ZIA / ZPA
• Microsoft Defender for Endpoint
• Microsoft Intune
• Microsoft Advanced Threat Protection
• KnowBe4
• Meraki Networking
• Tenable / Qualys
• Cybera Firewalls
• NCR
• Gilbarco
• Verifone Data Security

Additional Preferred Experience

• Working knowledge of retail payment systems and PCI DSS merchant-level requirements
• Experience operating within lean or resource-constrained IT/security organizations
• Experience coordinating MDR, SOC, or managed security service providers
• Working knowledge of scripting, automation, or programming concepts

Availability and Travel

• This is a hybridrolethat requires 2 to 3 days working onsite at our HQ in La Plata, MD, typically Tuesday, Wednesday, and Thursday, with the remainder remote/ at retail store locations. This is subject to change based onday to daytasks, project milestones, and business initiatives. Our core operating hours are Monday through Friday from 8:00 AM EST to 4:30 PM EST.

Why You Should Join Wills Group

As a thriving, family-owned, $1.5 billion company headquartered in scenic La Plata, Maryland, (a 45-minute commute from Washington, DC), we take pride in our strong presence across the Mid-Atlantic region. Featuring nearly 300 retail locations of our family of brands including Dash In, SplashIn ECOCar Wash, and SMO Motor Fuels, we are shaping the future of convenience retailing, fuels marketing, and commercial real estate.

Since 1926, our work-hard, play-hard mentality propels us to serve the communities that have supported us throughout the years. Keepinglives in motionis more than our mission--it's our way of life!We're dedicated to empowering individuals to embrace new possibilities and chart their own paths to success. Discover the fulfillment of working alongside passionate professionals, where your ideas are valued, and your potential is nurtured. Become part of something bigger when you join the Wills Group!

Benefits and Perks

Embark on a rewarding journey where your growth, future, and well-being take center stage! As a certified Great Place to Work™, the Wills Group understands today's professionals desire meaningful careers with a culture that's as authentic as possible. We pride ourselves in fostering an environment that supports your overall development. Look forward to joining a company that celebrates your wins whether big or small. You can count on us to provide industry-leading total rewards packages that include a range of benefits and perks that contribute to your overall well-being:

#TWGIHQ

#LI-TWGI