VP of Information Technology & Information Security

Our client is a hypergrowth holding company that buys and builds platform businesses in asset-light service industries. Its leadership team has co-founded 10 platforms over the past decade, with a strong track record of fast growth and strong returns. The company runs two offices, headquarters in Tampa with offices in New York City, and its platforms employ people across the country.

IT and information security have never had a dedicated owner. Today the COO oversees the MSP relationship and the VP of Technology Transformation covers security and tool configuration as time allows, on top of running his own team focused on software development and technology transformation. The VP of IT/IS will report to the COO and work alongside the VP of Technology Transformation. The company expects to roughly double its platform count next year, and each platform needs IT and security as soon as it joins.

The VP of IT/IS will own the function: pick the long-term support model and run the RFP, write the security policies the platforms follow, and set up IT so requests stop landing with the technology team. This is not a systems administration seat. When something breaks, leadership calls you, and you decide how it gets fixed.

The Mandate Own IT and information security for the company and its platforms. In the first 12 months, select an MSP through a completed RFP and have it running on SOPs and SLAs. Put security guardrails in place for access, data handling, vendor risk, and AI tool use, with business continuity and incident response procedures behind them. Design the IT environment, with the move from a single tenant to an interconnected multi-tenant environment as the leading hypothesis. Keep the systems the business already runs on supported and secure. Set the KPIs the function is measured on.

What You'll Own

Run the MSP RFP and own the result: Bring an informed hypothesis in the first weeks, pressure-test it with leadership, and get into an RFP faster than the usual 60 to 90 day discovery period without trading speed for decision quality. Weigh one MSP across every company, office, and virtual employee against a coordinated set of smaller, more collaborative MSPs on geography, pricing, technical strength, capacity, and SLAs. The role selects the provider, sets the SLAs, and holds them to it. The model starts MSP-led. You add internal hires over time where they make sense.

Be the escalation point: Oversee and escalate with MSPs day to day rather than administering systems yourself. Step in when an urgent or high-impact issue needs it.

Write the security policy and own the posture: Write the policies for access, data handling, vendor risk, and AI tool use, and get them adopted across the company and its platforms, along with the compliance certifications that go with them. Build the playbooks and standard configurations, including for AI tools, that each new platform adopts as-is so it starts secure.Each standard spells out where a platform may deviate, as long as the company’s own security is not affected. Business continuity planning and incident response are part of this role, not add-ons. The MSP implements most controls. This role decides which ones matter and is accountable for the result.

Architect the IT environment: The company is on a single tenant today. The leading hypothesis is that each platform needs to become its own tenant, connected so people can move between them and holding company staff keep seamless email and calendar access across domains. This role tests that hypothesis against the alternatives, recommends a design, leads the migration with the MSP, and sets consistent permissions, policies, and day-to-day administration across the core stack. Hold firm where interconnectivity needs structure, and give way where a platform has a good reason to do something differently.

Define the operating model and the KPIs: Onboarding, offboarding, provisioning, and tool access for the company and its platforms. Today those requests land with the technology transformation team. This role takes them, defines where IT stops and the technology transformation team starts, and agrees with that team how far each side extends into standing up platform IT and supporting post-acquisition integration. Set the KPIs the function is measured on, covering service quality, security posture, and cost, and a working rhythm with the technology transformation team that holds as the company grows.

Who We're Looking For

Information security program ownership: Required. Accountable owner of a security program: wrote the policies for access, data handling, vendor risk, and AI tool use, drove implementation through an MSP or MDR partner, and made the calls on which controls to fund first. Owned business continuity planning and incident response, not only preventative controls.

IT operations leadership: Required. Led end-to-end IT operations for a multi-office, growing organization (onboarding, offboarding, provisioning, access requests, end-user support) with KPIs, recruited and managed IT technicians directly, in-house or through a provider, and built the operating model rather than inheriting it.

High-growth operating environment: Required. Led IT in a company that grew fast through acquisition or organic scale, adding people, locations, or entities every year, and built systems, controls, and vendor capacity ahead of the growth. Can name what broke and what changed, including processes you rebuilt because the company outgrew them. Experience leading IT through a large integration, rebuild, or carve-out also counts. A private equity background is not required.

MSP selection and management: Preferred. Selected and managed an MSP as the primary delivery model, or led a large in-house IT operation that used outsourced providers for defined functions. Defined scope, set SLAs, held them to it, and replaced one that underperformed. Knows what to keep in-house and what to outsource.

RFP, vendor, and contract management: Preferred. Ran several competitive RFPs that solved for both IT/IS needs and business requirements, owned the contract negotiation and the implementation that followed, and manages a technology vendor portfolio today.

Microsoft ecosystem depth: Preferred. Ran a Microsoft 365, Entra, Intune, and Azure environment hands-on and speaks in specifics about tenant design, identity, device management, and security. Hands-on experience on a comparable stack counts if you can explain how you would do the same work in Microsoft 365.

Compliance frameworks and controls design: Preferred. Owned IT compliance against a recognized framework (HITRUST, HIPAA, NIST, or CMMC) in a business in a business with complex, interconnected data systems,where the requirements changed or multiplied. Designed a common controls set that satisfied more than one requirement at once, and used auditors, tools, and advisors rather than doing it alone.

Leading through influence: Preferred. Set IT/IS standards across independently led business units or portfolio companies without positional authority, with examples of leaders who asked for your help.

Technical fluency and currency: Preferred. Still hands-on, writing scripts or automation (PowerShell, Python, low-code), partnering with or managing engineers, and using AI tools in daily work. Speaks in specifics about how the stack works.

Operator mindset: Preferred. Thinks like an operator as well as a technologist. Written and presented technology recommendations to non-IT executives and driven a decision.

A plus, not expected: Post-acquisition IT integration experience, or a software background with hands-on application security work alongside engineering teams. An existing integration playbook and the technology team cover both.

Qualities That Will Make You Successful

Stays ahead of problems: You scan for vulnerabilities others miss and close them before they become incidents.

Curious: Open to new tools, new approaches, and views that challenge your own.

Turns risk into plain recommendations: Candid without being blunt. Executives get a clear recommendation they can act on, not a technical briefing.

Raises concerns with patience: You never trade long-term trust for a short-term win.

Known for the do:say ratio: Your reputation rests on doing what you said you would do.

Owns the fix: You find the root cause, keep access, policies, and records current, and bring a builder's urgency to the work.

Methodical without being rigid: You bring structure to fast-moving work, push hard on security, and adapt where the stakes are lower.

Relentless, not reckless: You keep up with a very fast-moving leadership team during the day and take the occasional off-hours fire drill in stride.

The Process

Published so you can judge the commitment before you engage.

Screening conversation with 10th St. Talent

In-depth career interview with 10th St. Talent

Culture and team fit interview with the COO and/or the head of technology

Technical competency interview with the VP of IT/IS at an affiliated platform company

Multi-science personality assessment and debrief with our assessment partner

Case study: a written plan and live presentation covering an information security roadmap and an IT/MSP RFP plan

Reference checks

Offer