Manager, Enterprise Security

The posting

Job Description:

POSITION SUMMARY:

The Manager, Enterprise Security is responsible for developing and executing Portillo’s enterprise cybersecurity strategy, ensuring security capabilities evolve with business priorities, technology modernization, and the company’s risk profile. This position defines the long-term security vision, strengthens governance, establishes architecture direction, evaluates emerging threats, and recommends the vendors, technologies, and capabilities needed to protect the business.

This role balances long-term planning with immediate business needs and rapidly changing technology and threat landscape, including the evolution of AI. It partners across the organization to integrate security into the design, implementation, and ongoing operation of Portillo’s systems, applications, data, integrations, and digital capabilities, across current and future enterprise platforms.

This position is based at the Portillo’s Restaurant Support Center in Oakbrook, Illinois with on-site presence required Monday through Thursday and flexibility to work remotely on Fridays.

CORE RESPONSIBILITIES:

Enable our Purpose to create lifelong memories by igniting the senses with unrivaled food and experiences:

Family: Work together to make everyone feel at home, and we step up when someone needs help

Greatness: We’re obsessed with being the best and work hard to continuously improve. Our greatness is rooted in Quality, Service, Attitude and Cleanliness

Energy: We move with urgency and passion, while maintaining attention to detail

Fun: We entertain our guests, we connect authentically, and we make each other smile

Enterprise Security Strategy and Roadmap

· Develop and maintain a multi-year enterprise cybersecurity strategy, roadmap, and budget aligned with Portillo’s business strategy, growth priorities, technology roadmap, and risk tolerance

· Monitor changes in the threat landscape, including emerging AI-enabled threats, and translate findings into practical security priorities and actions for the business

· Establish measurable security objectives and key risk and performance indicators; regularly communicate recommendations, gaps and progress to leadership

· Balance long-term security architecture and capability planning with near-term operational needs and business realities

· Align security planning and execution with initiatives supporting restaurant sales, catering growth, grand openings, and experiential initiatives

· Coordinate with Operations, Finance, Legal, Supply Chain, Risk, IT, Loyalty, Creative, and external partners to integrate security requirements into business initiatives

· Facilitate cross-functional communication and alignment to support efficient and consistent execution of security priorities

Security Architecture and Technology Governance

· Define enterprise security principles, standards, and architecture requirements for infrastructure, cloud services, business applications, data platforms and integrations

· Partner with technology and business leaders to embed security requirements into the selection, design, implementation, and ongoing operation of systems and applications

· Provide security direction for the Microsoft ecosystem, Oracle ERP, Workday, and other current and future enterprise platforms

· Ensure significant technology initiatives undergo appropriate security and risk reviews before implementation or major changes

AI Security and Emerging Technology

· Develop security standards and governance practices for generative AI, intelligent agents, automation, machine learning, and other emerging technologies

· Assess risks associated with AI use, including sensitive-data exposure, unauthorized tools, identity and access misuse, insecure integrations, model or agent manipulation, and evolving threat-actor capabilities

· Partner with business, data, legal, privacy, and technology stakeholders to enable responsible innovation while protecting company, team member, and guest information

Cybersecurity Governance, Risk, and Compliance

· Establish and maintain enterprise security policies, standards, control expectations, and governance processes

· Lead and coordinate security risk assessments for new systems, applications, vendors, integrations, and major business initiatives

· Guide the prioritization and remediation of identified security risks and control gaps, establishing clear ownership and accountability

· Partner with internal stakeholders and external resources to support audits, compliance requirements, privacy obligations, and cyber-insurance expectations

Identity, Access, and Data Protection

· Define the strategy for identity security, role-based access, privileged access, least privilege, access reviews, and administrative account governance

· Partner with application and business owners to strengthen access models and security controls across enterprise platforms

· Provide strategic direction for protecting sensitive information across Microsoft 365, cloud services, enterprise applications, endpoints, and data platforms

Security Operations and Resilience

· Provide strategic oversight for security monitoring, threat detection, vulnerability management, incident response, recovery readiness, and cyber resilience

· Ensure incident response plans, escalation paths, decision-making authority, and response partners are clearly defined, maintained, and exercised

Leadership and Business Partnership

· Build strong partnerships across Information Technology, Data, Digital, Operations, Finance, Human Resources, Marketing, Legal, and other business functions

· Support security awareness training, shared accountability, and risk-informed decision-making across the organization

· Provide direction and subject-matter leadership to internal team members, service providers, and project teams involved in security-related work

· Other duties as assigned

ORGANIZATION RELATIONSHIPS:

This position reports to the Chief Information Officer and partners closely with Information Technology, Data, Digital, Operations, Finance, Human Resources, Marketing, Legal, Internal Audit, and other business leaders. This position also coordinates with enterprise application owners, including Microsoft, Oracle ERP, and Workday stakeholders, as well as external security vendors, managed service providers, auditors, consultants, and other strategic partners.

QUALIFICATIONS:

Educational Level/Certifications

• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline preferred
• Relevant security certifications such as CISSP, CISM, CCSP, GIAC, or comparable credentials are preferred

Work Experience, Qualifications, Knowledge, Skills, Abilities

· 8+ years of progressive experience in cybersecurity, enterprise technology, infrastructure, cloud, application security, risk management, or related disciplines

· Demonstrated experience developing cybersecurity strategies, roadmaps, governance frameworks, standards, and investment recommendations

· Working knowledge of Microsoft security and compliance technologies, identity and access management, cloud and SaaS security, endpoint security, data protection, vulnerability management, incident response, and cyber resilience

· Experience evaluating security risks and control requirements for enterprise platforms such as Oracle ERP, Workday, Microsoft 365, Azure, data platforms, integrations, and AI-enabled solutions

· Experience selecting and managing security vendors, managed service providers, consultants, and technology partners, including holding them accountable for performance and results

· Ability to translate complex technical risks into clear business implications and actionable recommendations for executive and non-technical audiences

· Strong strategic thinking, judgment, influence, communication, collaboration, and prioritization skills

· Ability to operate as the senior-most security leader while remaining practical, hands-on, and focused on enabling the business

· Familiarity with security, privacy, payment-card, financial-control, and risk-management frameworks applicable to a multi-location restaurant organization is preferred

Travel Requirement

Occasional travel to Portillo’s restaurants, support locations, vendor sites, or business meetings may be required

RSC (all) & PFS Management

Hot dog! The pay range for this role is $130,000. - $155,000 per year salary. Your actual compensation will depend on experience, location, and/or additional skills you bring to the table.

This position is also served with:

• Participation in a discretionary bonus program based on company and individual performance, among other ingredients

• A monthly technology reimbursement
• Quarterly Portillo’s gift cards

• A bun-believable benefits package that includes medical, dental, and vision insurance along with paid time off, life insurance, and our 401(k) plan with a company match

• Learn more about our benefits here

DISCLAIMER: The above statements are intended to describe the general nature and level of work being performed by incumbents assigned to this job. This is not intended to be an exhaustive list of all the responsibilities, duties and skills required. The incumbent may be expected to perform other duties as assigned. This job may be reviewed as duties and responsibilities change with business necessity.