The posting
Working with Us
MBX Biosciences is a clinical-stage biopharmaceutical company headquartered in Carmel, Indiana, with a secondary office in Burlington, MA. Our mission is to transform the lives of people impacted by endocrine and metabolic disorders through our novel precision peptides.
Leveraging our proprietary Precision Endocrine Peptides (PEPs)™ platform, we are pioneering technology designed to overcome key limitations of existing therapies and enhance efficacy, tolerability, safety and convenience. Our team is advancing a pipeline of novel candidates with clinically validated targets, established endpoints for regulatory approval, and strong market potential.
Our pipeline includes canvuparatide (MBX 2109) for the treatment of chronic hypoparathyroidism, currently preparing for Phase 3 development, and a growing obesity portfolio that includes MBX 4291 in Phase 1 development, MBX 5765, a next-generation amycretin prodrug designed for once-monthly-dosing, as well as MBX 6180, a GLP/GIP/GCGR triple agonist prodrug for once monthly dosing; all of which optimize our PEP platform.
If you’re passionate about advancing innovative treatments for patients and shaping the future of precision peptide therapeutics, this is your chance to make a real impact alongside a fast-paced, growing, mission-driven team. To learn more, visit our website mbxbio.com and follow us on LinkedIn.
What You will Do
The Director, IT Infrastructure and Security, is a hands-on leader responsible for the reliability, security and scalability of the technology environment that supports MBX Biosciences as we advance our pipeline toward late-stage development. Reporting to the VP, IT, you will build and scale IT operations in a regulated environment, own the operational execution of our cybersecurity program in partnership with our fractional CISO, and help lead the security strategy and policy, and oversee cloud, network and Tier 1 and Tier 2 service desk operations. You will be well versed in modern advanced technologies, including generative and agentic AI, and will use them to strengthen security operations, improve insight into risk, and increase the efficiency of IT. This role combines strategic leadership with direct technical involvement and is ideal for someone who is equally comfortable setting direction with executives and rolling up their sleeves to solve problems alongside the team.
Key responsibilities include:
- Partner with the VP, IT and fractional CISO, in setting the overall security strategy and policy; own the execution of the cybersecurity program, including the roadmap, risk register and NIST CSF 2.0 standards, and report cyber risk to leadership and the Board.
- Apply generative and agentic AI to security operations and risk insight, including NIST CSF 2.0 assessment, prioritized remediation, and continuous control monitoring, to speed detection and response.
- Oversee security operations, including threat detection and response, vulnerability and patch management, endpoint and email security, and incident response, working with MDR/MSSP partners and joining investigations as needed.
- Own the identity and access management program, including conditional access, phishing-resistant MFA, MFA registration controls, and privileged access.
- Define secure architecture standards for cloud, network, identity, and data protection to safeguard intellectual property, clinical data, and corporate data.
- Partner with Legal, Quality, Data, and business leaders on responsible AI governance, including approved use cases, data protection, access controls, human oversight and AI risk assessment, aligned to the NIST AI Risk Management Framework.
- Prepare Microsoft 365 for Copilot and AI, including SharePoint permissions, sensitivity labels, data loss prevention, and data classification.
- Oversee cloud and network operations, including Microsoft 365, LAN/WAN, wireless, firewalls and remote access for our Carmel and Burlington offices and remote workforce, ensuring availability, performance, and cost effectiveness.
- Lead Tier 1 and Tier 2 service desk operations, including endpoint and mobile device management, onboarding and offboarding, service levels, and end user experience.
- Build and scale ITIL-aligned IT processes, test backup, disaster recovery, and ransomware recovery annually, including executive incident response tabletops.
- Ensure IT systems, controls and documentation meet regulatory and audit requirements, such as GxP, 21 CFR Part 11, SOX IT general controls, and privacy laws, in partnership with Quality, Legal, Finance and the business.
- Prepare IT and security for regulatory inspections and commercial launch, including audit evidence and a risk-based computer system validation and change-control approach (Annex 11, data integrity).
- Own the multi-year infrastructure, operations and security roadmap and budget, prioritizing by business need and cyber risk, and report KPIs and risk indicators (SLAs, patch aging, response times, recovery objectives, cost) to the VP, IT, and executive leadership.
- Plan infrastructure and security for the shift from clinical to commercial stage, including new sites, CRO and CDMO data sharing, and expanded compliance scope.
- Consolidate and govern managed service, MDR/MSSP and service desk providers, including contracts, SLAs, budget, and third-party risk.
- Over time, hire, coach, and develop a high-performing team, and build a culture of security awareness, including phishing simulation and role-based training.
What You Bring
- Bachelor’s degree in IT, Computer Science, Cybersecurity or a related field, or equivalent experience; advanced degree preferred.
- 10+ years of progressive experience in IT infrastructure, operations, and security, including at least 5 years in leadership.
- Demonstrated experience building and scaling IT operations in a regulated environment such as biotechnology, pharmaceuticals, life sciences, or healthcare; familiarity with GxP, 21 CFR Part 11, SOX and computer system validation preferred.
- Proven ability to run cybersecurity operations and partner head of IT and fractional CISO on strategy, policy, and risk management, with working knowledge of NIST CSF 2.0, ISO 27001 or similar frameworks.
- Well versed in modern technologies, including generative and agentic AI, with practical experience applying AI to security operations and insight, such as assessing control posture against NIST CSF 2.0, driving remediation and monitoring controls.
- Strong hands-on expertise in Microsoft 365, Microsoft Entra, Okta, Intune, Defender, Azure and other cloud platforms, identity and access management, endpoint management, enterprise networking and firewalls, and security monitoring and response tools such as SIEM and XDR platforms.
- Experience overseeing Tier 1 and Tier 2 service desk operations and outsourced providers, including MDR/MSSP relationships and ITSM tools such as Freshservice, ServiceNow with a record of improving service levels and end user satisfaction.
- Experience with incident response, vulnerability management, vendor risk management, and audit readiness.
- Experience supporting regulatory inspections or audits, such as FDA pre-approval or BIMO inspections, in an IT or security capacity preferred.
- Understanding of the security, privacy and compliance risks of AI, and experience evaluating and safely deploying AI tools, such as Microsoft Copilot and security automation, in a regulated environment.
- Excellent communication skills, including the ability to translate technical risk into business terms for executives and the Board and to collaborate across functions in a fast-paced, growing organization.
- Certifications such as CISSP, CISM, CISA, CCSP, ITIL or Microsoft Azure preferred.
Travel & In Office Presence
You will be expected to travel periodically based on the needs of the business, including attendance at Together Weeks, Together Days, and functional meetings as requested by the team. Employees are expected to work on hybrid schedules, consistent with local office practices and the terms of the companies in office policy as in effect from time to time.
EEO Statement:
MBX Biosciences is an Equal Opportunity Employer and is committed to treating all applicants fairly without discrimination. We welcome applications from all individuals, regardless of race, national origin, gender, age, physical characteristics, social origin, disability, union membership, religion, family status, pregnancy, sexual orientation, gender identity, gender expression or any unlawful criterion under applicable law.
