1) Role Summary

The VP of IT is the senior executive accountable for the strategy, reliability, security posture, and cost-effectiveness of the company’s internal technology ecosystem—end-user computing, identity and access, corporate networks, IT service management, enterprise applications, and the foundational services employees rely on to build, sell, and support software. This role ensures that internal IT is a business enabler: secure by design, resilient by default, and optimized for employee productivity and operational excellence.

This role exists in software and IT organizations because fast-growing product and go-to-market teams create compounding demand for scalable access, secure collaboration, reliable systems, and governed data flows across corporate functions. The VP of IT creates business value by reducing downtime and friction, hardening security controls, enabling compliance, accelerating onboarding and change delivery, and rationalizing IT spend through vendor, platform, and portfolio discipline.

This is a Current role with mature practices and well-established accountabilities across IT operations, enterprise systems, and service management. The VP of IT typically works closely with Engineering/Product leadership, Security, Finance, HR, Legal/Compliance, Revenue Operations, and Facilities/Workplace teams (where applicable).

Typical functions and teams this role interacts with: – Executive leadership (CEO/COO/CFO/CTO/CIO, depending on structure) – Security leadership (CISO/Head of Security; GRC; SecOps) – Finance (FP&A, procurement, audit) – People/HR and Talent Operations (onboarding, device policy, HRIS integration) – Legal and Compliance (contracts, data privacy, regulatory audits) – Engineering/IT platform teams (identity, endpoint management, network, collaboration tooling) – Business systems owners (CRM, ERP, HRIS, ticketing, analytics) – Customer support and IT operations (incident response, knowledge management) – Workplace/Facilities (if IT also owns conference rooms, telephony, physical access integrations)

2) Role Mission

Core mission: Build and run a secure, reliable, and scalable internal IT capability that maximizes employee productivity, protects company and customer data, and delivers measurable business outcomes through modern platforms, disciplined service management, and cost governance.

Strategic importance: In a software company, internal IT is a force multiplier: it directly impacts engineering velocity (access, environments, tooling), revenue productivity (CRM uptime, quoting/billing operations), customer responsiveness (support platforms, analytics), and risk posture (identity controls, audit readiness, vendor risk). The VP of IT ensures the company can scale headcount, systems, and global operations without fragile processes or compounding operational risk.

Primary business outcomes expected: – High availability and predictable performance of critical corporate systems (identity, collaboration, CRM, finance systems). – Reduced security and compliance risk through standard controls, automation, and governance. – Faster employee onboarding, change delivery, and issue resolution through mature ITSM practices. – Transparent IT financial management (run vs. change spend), vendor performance, and predictable budgeting. – A modern, measurable, and continuously improving IT operating model aligned to business priorities.

3) Core Responsibilities

Strategic responsibilities

1. Define IT strategy and multi-year roadmap aligned to company growth, operating model, and risk appetite (security, compliance, resilience).
2. Establish IT operating model (ITSM processes, service ownership, SLOs/SLAs, governance forums, and performance management).
3. Lead enterprise application and platform strategy (collaboration suite, identity, endpoint, network, CRM/ERP/HRIS integrations) to reduce fragmentation and shadow IT.
4. Drive IT financial management: budget planning, chargeback/showback (when appropriate), cost optimization, and investment prioritization.
5. Set vendor and sourcing strategy: build vs. buy decisions, MSP management, contract negotiation approach, and vendor risk controls.
6. Own IT resilience strategy: business continuity, disaster recovery (DR) for internal systems, and crisis communications for major outages.
7. Create a workforce plan for IT capabilities, including hiring, outsourcing, succession planning, and skills development.

Operational responsibilities

8. Run IT service delivery across incident, request, problem, change, and knowledge management; ensure high-quality support experience.
9. Own service reliability and uptime for business-critical services (SSO, email, conferencing, CRM, finance systems) and ensure proactive monitoring and capacity planning.
10. Establish endpoint lifecycle management (procure, image, deploy, patch, secure, recover, and retire) including global logistics where relevant.
11. Standardize onboarding/offboarding workflows integrated with HR and identity systems to minimize access risk and improve time-to-productivity.
12. Implement and manage asset management (hardware/software inventory), software entitlement, and audit defense.
13. Operate a mature escalation and major incident function with clear on-call expectations, executive communications, and post-incident learning.

Technical responsibilities

14. Own identity and access management (IAM) strategy and operations, including SSO, MFA, RBAC, privileged access, lifecycle automation, and access reviews.
15. Oversee network and connectivity services (office networks, remote access/VPN/zero trust, DNS, Wi-Fi, conferencing rooms) aligned to security and productivity.
16. Guide enterprise systems architecture for internal applications, integrations (iPaaS), and data flows with security-by-design.
17. Partner on security controls implementation (device compliance, encryption, EDR, DLP, conditional access) with Security, clarifying ownership boundaries.
18. Define standards for SaaS governance: app catalog, approval workflow, data classification alignment, and integration patterns.

Cross-functional or stakeholder responsibilities

19. Translate business needs into IT capabilities by partnering with functional leaders (Sales, Marketing, Finance, HR, Support) on requirements, prioritization, and adoption.
20. Enable engineering and product teams with reliable access, tooling, and secure developer productivity services while preventing policy friction.
21. Coordinate with Finance and Procurement on vendor selection, contracting, renewals, and cost-control measures.
22. Lead change management and communications for IT rollouts (new collaboration policies, device changes, system migrations) to drive adoption and reduce disruption.

Governance, compliance, or quality responsibilities

23. Own IT policies and standards (acceptable use, endpoint security, SaaS procurement, access control, data handling) and ensure enforcement through automation where feasible.
24. Support compliance and audit readiness (e.g., SOC 2, ISO 27001, SOX, GDPR/CCPA) by maintaining control evidence, system inventories, and process documentation.
25. Establish metrics and reporting for IT performance, risk indicators, and business outcomes; maintain dashboards for executives and service owners.
26. Ensure third-party risk alignment by partnering with Security and Legal on vendor assessments, security questionnaires, and contractual control requirements.

Leadership responsibilities

27. Build and lead the IT leadership team (directors/managers for service desk, enterprise apps, IAM, endpoint, network) with clear accountabilities and development plans.
28. Set a culture of operational excellence: blameless postmortems, continuous improvement, automation, and customer-centric service design.
29. Develop talent and succession through coaching, calibrated performance reviews, career paths, and capability building.
30. Represent IT at executive level: articulate tradeoffs, present plans, manage risk decisions, and influence enterprise priorities.

4) Day-to-Day Activities

Daily activities

• Review operational health: priority incidents, major alerts, service desk backlog, endpoint compliance posture, and IAM exceptions.
• Remove blockers for teams executing migrations, automations, or integration work (e.g., SSO rollout issues, CRM workflow changes).
• Approve or delegate key access exceptions and high-risk changes (privileged access, conditional access policy changes, core system updates).
• Handle executive escalations (VIP support, revenue-impacting system issues, onboarding delays for critical hires).
• Maintain ongoing vendor communications for urgent support cases (cloud identity provider outage, CRM incident, ISP issues).

Weekly activities

• Run or review IT leadership staff meeting: metrics, risks, staffing, delivery progress, escalations, and decision items.
• Review service management trends: incident themes, SLA performance, top request drivers, problem records, and knowledge gaps.
• Portfolio and roadmap governance: prioritize requests with functional leaders, validate dependencies, and align to quarterly planning.
• Financial reviews: renewal calendar, spend anomalies (shadow SaaS), and optimization opportunities (license right-sizing).
• Security alignment: review device compliance and IAM posture, open audit items, DLP policy tuning, vendor risk escalations.

Monthly or quarterly activities

• Present IT performance and roadmap progress to executive leadership (KPIs, risks, budget variance, delivery status).
• Conduct quarterly access reviews for key systems and privileged roles with system owners and Security/GRC.
• Run quarterly resilience reviews: DR readiness checks, tabletop exercises, and improvements to runbooks.
• Talent management: hiring pipeline reviews, performance calibration, skills development plans, and succession mapping.
• Vendor quarterly business reviews (QBRs): performance against SLAs, roadmap alignment, contract terms, and escalation patterns.

Recurring meetings or rituals

• Major Incident Review (weekly): themes, corrective actions, owners, due dates, and learning dissemination.
• Change Advisory Board (CAB) (weekly/bi-weekly, scaled to maturity): review high-risk changes and maintenance windows.
• IT/Business Systems Steering Committee (monthly): cross-functional prioritization and funding decisions.
• Security/IT Controls Working Group (bi-weekly/monthly): control evidence status, audit requests, and remediation tracking.
• Architecture/Integration Review (bi-weekly): evaluate new SaaS requests, integration patterns, and data flow approvals.

Incident, escalation, or emergency work

• Own executive-facing communication during major outages affecting identity, collaboration, CRM, or finance systems.
• Coordinate cross-team response between IT, Security, Engineering, and vendors (including contractual escalation paths).
• Ensure a structured post-incident process: root cause analysis, containment, corrective/preventative actions, and verification of fixes.
• Lead urgent risk response (e.g., zero-day affecting endpoints, compromised credentials, vendor breach) in partnership with Security.

5) Key Deliverables

Concrete deliverables expected from the VP of IT include:

Strategy and planning – IT strategy deck and multi-year roadmap (capabilities, sequencing, dependencies, investment case). – Annual IT operating plan (budget, headcount, vendor strategy, delivery portfolio). – Technology lifecycle plan (endpoint refresh, SaaS rationalization, network upgrades).

Operating model and governance – IT service catalog with service owners, SLAs/SLOs, and escalation paths. – ITSM process documentation (incident/problem/change/request/knowledge) and a continuous improvement backlog. – Governance cadence: steering committee charter, CAB model, and risk acceptance workflow.

Security, risk, and compliance artifacts – IAM standards (MFA, conditional access, privileged access controls, joiner-mover-leaver automation). – Device security baseline (MDM policies, encryption, patch cadence, EDR standards). – SaaS governance policy and app intake workflow; third-party tool risk tiering model (in partnership with Security). – Audit evidence packs (system inventory, access review results, control documentation, change logs).

Systems and platforms – Standardized endpoint images/build profiles and automated provisioning workflows. – Modern identity architecture: SSO integrations, lifecycle automation, access review automation. – Enterprise applications roadmap and integration architecture (CRM/ERP/HRIS/ticketing analytics flows). – DR/BCP runbooks for internal systems and critical workflows.

Reporting and performance – Executive dashboards: IT availability, SLA performance, ticketing health, endpoint compliance, IAM metrics, cost and license utilization. – Vendor scorecards and renewal calendar with financial impact and negotiation plans. – Post-incident reports and problem management summaries with trend analysis.

Enablement and adoption – Internal knowledge base and self-service portal improvements. – Training artifacts: security-aware onboarding guides, collaboration standards, tooling playbooks. – Change communication plans for major migrations (email/security tools/CRM workflows).

6) Goals, Objectives, and Milestones

30-day goals

• Establish relationships with executive peers and functional leaders; confirm expectations, pain points, and risk concerns.
• Review IT org structure, on-call and escalation patterns, service desk health, and backlog composition.
• Assess critical systems inventory: identity, endpoint, collaboration, CRM/ERP/HRIS, finance systems, and integration points.
• Baseline current-state metrics: availability, MTTR, SLA attainment, ticket volume by category, endpoint compliance, license utilization.
• Identify top 5 “stability and risk” gaps and implement immediate mitigations (e.g., enforce MFA where missing, patch critical endpoint exposure, stabilize core integrations).

60-day goals

• Publish a draft IT strategy and operating model proposal with clear service ownership and governance cadence.
• Define and socialize IT service catalog and escalation model; reduce “who owns what” ambiguity.
• Implement or tighten core controls: joiner-mover-leaver automation improvements, privileged access practices, device compliance policies.
• Launch SaaS governance intake workflow to reduce shadow IT and contract sprawl.
• Prioritize a 90–180 day execution plan with measurable outcomes and staffing/vendor needs.

90-day goals

• Deliver executive-approved IT roadmap and budget narrative (run vs. change spend, ROI, risk reduction).
• Improve support experience measurably: reduce ticket backlog, improve first-contact resolution, and enhance self-service.
• Establish major incident management and postmortem discipline; publish a recurring ops review dashboard.
• Complete at least one high-impact “stability or productivity” initiative (e.g., SSO rollout for top apps, device provisioning automation, CRM performance stabilization).
• Align with Security on a shared responsibility model for controls, evidence, and incident coordination.

6-month milestones

• Achieve visible reliability and productivity improvements: reduced P1/P2 incident frequency, improved onboarding time, higher endpoint compliance.
• Complete initial phase of SaaS rationalization (license right-sizing and consolidation) with demonstrable cost savings.
• Mature ITSM processes (problem management, change management) and show reduced repeat incidents.
• Implement consistent asset management and software compliance posture (accurate inventory, entitlement tracking).
• Complete at least one cross-functional platform modernization (e.g., CRM workflow overhaul, iPaaS adoption for key integrations, HRIS provisioning integration).

12-month objectives

• Operate IT as a measurable product: defined services, SLOs, dashboards, and continuous improvement loops.
• Demonstrably reduce audit and security risk: access reviews at cadence, privileged access controls, evidence collection automation, reduced policy exceptions.
• Improve employee productivity outcomes: faster onboarding, fewer recurring issues, higher satisfaction scores.
• Establish a sustainable IT cost model: predictable renewals, vendor performance management, optimized licensing, and investment discipline.
• Build a strong IT leadership bench with clear succession paths and improved engagement/retention.

Long-term impact goals (18–36 months)

• A scalable global IT capability supporting growth, acquisitions, and distributed work with minimal friction.
• A modern internal platform ecosystem that reduces time-to-market for internal process changes and reporting needs.
• Mature governance and controls that enable faster audits, faster vendor onboarding, and safer experimentation.
• A culture where IT is seen as a strategic partner, not a ticket queue—measured by stakeholder NPS and involvement in planning.

Role success definition

Success is achieved when internal IT is predictably reliable, secure by default, financially disciplined, and highly enabling for the business—demonstrated through measurable improvements in uptime, support performance, onboarding speed, audit readiness, and stakeholder satisfaction.

What high performance looks like

• Proactive prevention of incidents through problem management, observability, and standardization.
• Clear, executive-ready storytelling: risks, tradeoffs, ROI, and progress.
• Strong talent density and leadership maturity within IT; low dependency on heroics.
• Consistent delivery of roadmap outcomes without destabilizing operations.
• Trusted partnerships with Security, Finance, HR, and Engineering—leading to faster decisions and less rework.

7) KPIs and Productivity Metrics

A practical measurement framework for the VP of IT should balance service reliability, employee experience, risk reduction, delivery throughput, and financial stewardship.

KPI framework table

Metric name	What it measures	Why it matters	Example target / benchmark	Frequency
Core service availability (Identity/SSO)	Uptime of SSO/IdP	Identity outages stop work across the company	≥ 99.95% monthly	Weekly/Monthly
Core service availability (Email/Collab)	Uptime for email/chat/conferencing	Directly impacts productivity and customer responsiveness	≥ 99.9% monthly	Monthly
Core business app availability (CRM)	Uptime and critical workflow success	Sales execution and forecast integrity depend on CRM	≥ 99.9% monthly	Monthly
MTTA (Mean Time to Acknowledge)	Time to acknowledge P1/P2 incidents	Reflects operational readiness and on-call effectiveness	P1 < 5 min; P2 < 15 min	Weekly
MTTR (Mean Time to Restore)	Time to restore service	Measures operational effectiveness and impact duration	P1 < 60–120 min (context-dependent)	Weekly/Monthly
Incident recurrence rate	% of incidents recurring within 30/60 days	Indicates problem management maturity	< 10–15% recurring	Monthly
Change failure rate	% of changes causing incidents/rollbacks	Balances speed with stability	< 5–10% (scaled by maturity)	Monthly
Ticket SLA attainment	% of tickets meeting SLA	Demonstrates service performance predictability	≥ 90–95%	Weekly/Monthly
First contact resolution (FCR)	% resolved without escalation	Measures efficiency and knowledge quality	40–70% depending on scope	Monthly
Backlog age	Tickets older than X days	Reflects flow efficiency and staffing adequacy	< 10% older than 14 days	Weekly
Employee IT CSAT	Satisfaction after ticket resolution	Direct indicator of employee experience	≥ 4.5/5 (or ≥ 50 NPS)	Monthly/Quarterly
Onboarding time-to-productivity	Time from start date to fully provisioned	Key to scaling hiring and productivity	< 4 hours for standard roles (target); < 24 hours max	Weekly/Monthly
Offboarding completion time	Time to disable access and recover assets	Reduces data leakage risk	Same day; ideally < 2 hours	Weekly
Endpoint compliance rate	% devices meeting baseline	Major risk and audit control indicator	≥ 95–98%	Weekly
Patch compliance (critical)	Time to patch critical vulnerabilities	Reduces exposure to ransomware/zero-days	Critical patched in < 7–14 days	Weekly
MFA adoption rate	% users/apps protected by MFA	Foundational control for account security	100% for workforce identity	Monthly
Privileged access coverage	% admin accounts under PAM/controls	Reduces blast radius of compromise	≥ 95–100%	Monthly
Access review completion	Completion rate for quarterly reviews	Audit readiness and least privilege enforcement	100% by due date	Quarterly
SaaS spend under management	% SaaS spend tracked/governed	Shows reduction of shadow IT	≥ 90–95%	Quarterly
License utilization efficiency	Active use vs paid licenses	Cost optimization lever	10–20% savings opportunity identified annually	Monthly/Quarterly
Vendor SLA adherence	Vendor performance against contract	Reduces operational risk and drives accountability	≥ 95% compliance	Quarterly
Project/initiative delivery predictability	On-time/on-scope delivery of IT roadmap	Demonstrates execution competence	≥ 80–90% planned outcomes delivered	Quarterly
Automation rate for common requests	% top requests automated/self-service	Improves scale and employee experience	Automate top 5 requests within 6–12 months	Quarterly
Audit findings (IT-owned)	Number/severity of findings	Reflects control effectiveness	0 critical/high; decreasing trend	Quarterly/Annually
Stakeholder satisfaction (exec peers)	Qualitative score from leaders	Measures trust and alignment	≥ 4/5 across peers	Quarterly
IT team engagement/retention	Attrition and engagement metrics	Sustains capability and reduces knowledge loss	Voluntary attrition below company benchmark	Semi-annual

Notes on benchmarks: – Targets vary with company size, global footprint, and regulatory requirements. – Early-stage environments may prioritize establishing baselines and improving trends rather than absolute targets.

8) Technical Skills Required

Must-have technical skills

1. IT Service Management (ITSM) and operations – Description: Incident, problem, change, request, knowledge management; service catalog; SLAs/SLOs. – Use: Establish operating rhythm, run reliable support, reduce repeat incidents, and drive continuous improvement. – Importance: Critical

2. Identity and Access Management (IAM) – Description: SSO, MFA, RBAC, conditional access, lifecycle provisioning, access reviews. – Use: Control access to SaaS and internal apps; reduce account compromise risk; support audits. – Importance: Critical

3. Endpoint management and security basics – Description: MDM/UEM, patching, encryption, EDR coordination, device compliance enforcement. – Use: Standardize device fleet, reduce risk, and improve onboarding/offboarding. – Importance: Critical

4. SaaS governance and enterprise applications oversight – Description: App portfolio management, integrations, data flow awareness, license management. – Use: Reduce tool sprawl, improve integration reliability, and optimize spend. – Importance: Critical

5. Networking fundamentals for corporate environments – Description: Remote access models, office network basics, DNS, Wi-Fi, zero trust concepts. – Use: Ensure reliable connectivity for distributed teams; coordinate secure access patterns. – Importance: Important (Critical if IT owns networks end-to-end)

6. Security controls collaboration (shared responsibility) – Description: Understanding of security controls: device posture, DLP, log retention, vulnerability remediation, vendor risk. – Use: Partner with Security and implement controls without crippling productivity. – Importance: Important

7. IT financial management – Description: Budgeting, forecasting, vendor management, license optimization, renewal governance. – Use: Manage spend and demonstrate ROI; reduce waste and contract risk. – Importance: Critical

8. Systems integration literacy – Description: APIs, iPaaS concepts, identity provisioning (SCIM), data sync patterns, webhook/event basics. – Use: Oversee integrations between HRIS/IdP/CRM/ERP; reduce brittle workflows. – Importance: Important

Good-to-have technical skills

1. Cloud platform familiarity (AWS/Azure/GCP) – Use: Partner with Engineering/Infrastructure teams; understand identity and network integrations. – Importance: Optional (often Important in cloud-heavy companies)

2. Observability and monitoring – Use: Ensure proactive detection for internal systems and critical workflows. – Importance: Important

3. Collaboration platform administration – Description: Email security posture, retention, eDiscovery coordination, chat governance. – Use: Reduce risk and improve productivity; meet compliance needs. – Importance: Important

4. Enterprise architecture methods – Use: Standardize tech decisions, integration patterns, and system boundaries. – Importance: Optional (becomes Important at scale)

5. Data governance basics – Use: Align tooling to data classification, retention, and access control. – Importance: Optional/Context-specific

Advanced or expert-level technical skills

1. Zero Trust architecture concepts – Use: Transition from VPN-heavy models to identity/device-aware access. – Importance: Context-specific (Critical in high-security environments)

2. Privileged Access Management (PAM) design – Use: Reduce administrator risk and audit exposure. – Importance: Important

3. Business continuity and disaster recovery planning – Use: Ensure internal systems and processes remain operational under disruption. – Importance: Important

4. SaaS security posture management (SSPM) concepts – Use: Continuous monitoring of SaaS configurations and risky sharing. – Importance: Optional (increasingly important)

Emerging future skills for this role (next 2–5 years)

1. AI-enabled IT operations (AIOps) – Description: Using AI for event correlation, anomaly detection, and incident summarization. – Use: Improve MTTR and reduce alert fatigue. – Importance: Important

2. Automation-first service delivery – Description: Self-healing workflows, identity-driven provisioning, policy-as-code for IT controls. – Use: Scale without linear headcount growth. – Importance: Important

3. SaaS posture automation and continuous controls monitoring – Description: Automated evidence collection and control testing for audits. – Use: Reduce audit burden and improve control reliability. – Importance: Important (especially regulated contexts)

4. Digital employee experience (DEX) engineering – Description: Quantitative measurement of endpoint/app performance and employee friction. – Use: Proactively fix productivity issues; support distributed workforce. – Importance: Optional (trend increasing)

9) Soft Skills and Behavioral Capabilities

1. Executive communication and narrative clarity – Why it matters: The VP of IT must communicate risk, tradeoffs, and investment needs in business language. – How it shows up: Board/executive updates, outage communications, roadmap proposals, budget narratives. – Strong performance: Clear, concise messaging; proactive alignment; no surprises; credible framing of risk and ROI.

2. Stakeholder management and negotiation – Why it matters: IT priorities compete across functions; the role must broker agreements. – How it shows up: Roadmap tradeoffs, security-policy friction, tool standardization, deprecations. – Strong performance: Transparent prioritization; documented decisions; high adoption and low political resistance.

3. Operational judgment under pressure – Why it matters: Major incidents require calm leadership and fast decisions. – How it shows up: Incident command, escalation, vendor coordination, executive updates. – Strong performance: Fast triage, clear roles, effective comms, and disciplined post-incident improvements.

4. Customer-centric service mindset (internal customers) – Why it matters: Poor IT experience creates productivity drag and shadow IT. – How it shows up: Service design, self-service enablement, knowledge base quality. – Strong performance: Reduced friction, higher CSAT, measurable productivity gains.

5. Systems thinking – Why it matters: IT problems are often cross-system (identity + device + SaaS + process). – How it shows up: Root cause analysis, architecture decisions, integration strategy, governance design. – Strong performance: Fewer recurring issues; simplified platforms; cleaner ownership boundaries.

6. Talent leadership and coaching – Why it matters: Sustainable IT performance requires strong managers and clear growth paths. – How it shows up: Hiring, performance management, delegation, leadership development. – Strong performance: High engagement, improved team capability, reduced hero dependence.

7. Change leadership and adoption management – Why it matters: IT initiatives fail without adoption (new tools, policies, migrations). – How it shows up: Communication plans, pilot programs, training, phased rollouts. – Strong performance: High adoption rates, minimal disruption, measurable improvement post-rollout.

8. Financial discipline and vendor rigor – Why it matters: SaaS sprawl can silently become a major cost center. – How it shows up: Renewal governance, license optimization, vendor scorecards. – Strong performance: Predictable budgets, fewer surprise renewals, documented savings and risk reductions.

9. Integrity and risk-based decision-making – Why it matters: IT often mediates between speed and control; shortcuts can create material risk. – How it shows up: Policy exceptions, access approvals, audit evidence quality. – Strong performance: Clear risk acceptance decisions, traceability, and consistent control enforcement.

10) Tools, Platforms, and Software

Common tools vary by company size and stack. The VP of IT should be fluent enough to govern outcomes, even if not hands-on.

Category	Tool, platform, or software	Primary use	Common / Optional / Context-specific
ITSM	ServiceNow	Enterprise ITSM workflows, CMDB, reporting	Context-specific (common in large enterprises)
ITSM	Jira Service Management	Ticketing, change/request workflows	Common
ITSM	Zendesk	Service desk (often Support + IT)	Optional
IAM / SSO	Okta	SSO, lifecycle management, access policies	Common
IAM / SSO	Microsoft Entra ID (Azure AD)	Identity, SSO, conditional access	Common
IAM Governance	SailPoint	Access governance, reviews, provisioning	Context-specific
PAM	CyberArk	Privileged access controls	Context-specific
PAM	BeyondTrust	Privileged access, remote admin	Context-specific
Endpoint Management	Microsoft Intune	MDM/UEM, compliance policies	Common
Endpoint Management	Jamf	Apple device management	Common (if Mac-heavy)
Endpoint Security	CrowdStrike	EDR, endpoint protection	Common
Endpoint Security	Microsoft Defender for Endpoint	EDR/security posture	Common
Collaboration	Microsoft 365	Email, Teams, SharePoint, OneDrive	Common
Collaboration	Google Workspace	Email, Drive, Meet	Common
Collaboration	Slack	ChatOps and collaboration	Common
Video/Meetings	Zoom	Video conferencing	Optional (depends on suite)
Knowledge Base	Confluence	Documentation, KB	Common
Knowledge Base	Notion	Documentation, internal wikis	Optional
Device/DEX	Nexthink	Digital employee experience analytics	Context-specific
Monitoring	Datadog	Monitoring for services and integrations	Optional/Context-specific
Monitoring	Splunk	SIEM/log analytics (often Security-owned)	Context-specific
Monitoring	Microsoft Sentinel	SIEM (often Security-owned)	Context-specific
Security / DLP	Microsoft Purview	DLP, retention, eDiscovery	Context-specific
Security / DLP	Google Vault	Retention/eDiscovery (Workspace)	Context-specific
SSPM	AppOmni	SaaS posture management	Optional (growing)
SSPM	Adaptive Shield	SaaS security posture	Optional (growing)
iPaaS / Automation	Workato	Workflow automation/integrations	Context-specific
iPaaS / Automation	MuleSoft	Enterprise integrations	Context-specific
iPaaS / Automation	Zapier	Lightweight automation	Optional (govern carefully)
Source Control	GitHub	Manage scripts/infra-as-code for IT automation	Optional
Source Control	GitLab	Repo + CI for automation	Optional
Secrets	1Password Business	Credential management	Common
Secrets	Bitwarden	Credential management	Optional
Project Management	Asana	Initiative tracking	Optional
Project Management	Jira	Project tracking (shared with engineering)	Common
Asset Management	Lansweeper	Asset discovery/inventory	Context-specific
Asset Procurement	CDW / SHI (provider category)	Device procurement and lifecycle logistics	Context-specific
MDM Add-ons	Apple Business Manager	Automated Apple device enrollment	Common (Apple fleets)
MDM Add-ons	Windows Autopilot	Zero-touch Windows provisioning	Common (Windows fleets)
Network	Cisco Meraki	Office networking and management	Optional
Network	Palo Alto Prisma Access	Secure access/zero trust	Context-specific
Remote Support	TeamViewer	Remote assistance	Optional
Remote Support	BeyondTrust Remote Support	Remote support with controls	Context-specific
CRM	Salesforce	Core revenue system	Common (many SaaS companies)
ERP/Finance	NetSuite	Finance/ERP	Common
HRIS	Workday	HR system of record	Context-specific
HRIS	BambooHR	HR system of record (mid-market)	Optional
Analytics	Power BI	Reporting and dashboards	Optional
Analytics	Tableau	Reporting and dashboards	Optional

11) Typical Tech Stack / Environment

Infrastructure environment

• Primarily SaaS-first corporate IT environment with a limited on-prem footprint (conference room gear, office networks, printers—if any).
• Identity-centric access model anchored on an IdP (Okta or Entra ID), with MFA and conditional access.
• Device fleets typically split across macOS and Windows; managed via Intune and/or Jamf with automated enrollment (ABM/Autopilot).
• Office networks managed via cloud-managed networking (e.g., Meraki) or enterprise network stack; remote workforce supported with VPN or zero trust access.

Application environment

• Enterprise application portfolio typically includes:
• Collaboration suite (Google Workspace or Microsoft 365)
• Ticketing/ITSM (JSM/ServiceNow)
• CRM (Salesforce)
• Finance/ERP (NetSuite or equivalent)
• HRIS (Workday/BambooHR)
• Customer support platform (often separate, but integrations matter)
• Integration approach ranges from ad hoc APIs to iPaaS (Workato/MuleSoft) as scale increases.

Data environment

• Operational reporting across ITSM metrics, asset inventory, SaaS usage, and license utilization.
• Increasing need for governed reporting across CRM/finance/HR data for internal analytics, typically owned by RevOps/Finance/Data teams, but IT must ensure reliability and access governance.

Security environment

• Shared responsibility with Security:
• Security typically owns SIEM, threat detection, and security incident response.
• IT typically owns device posture enforcement, identity lifecycle workflows, and baseline configuration standards.
• Audit requirements vary:
• Mid-market SaaS: SOC 2 Type II is common; SOX becomes relevant post-IPO.
• Privacy requirements (GDPR/CCPA) create governance requirements for tools and data handling.

Delivery model

• Portfolio includes a mix of:
• “Run” work: support, incidents, standard requests, lifecycle operations.
• “Change” work: migrations, tool rollouts, integration builds, automation.
• Delivery may follow agile principles (quarterly planning, backlogs), but typically needs a pragmatic hybrid to balance operational interrupts.

Agile or SDLC context

• IT initiatives often use:
• Quarterly planning aligned to business objectives (OKRs).
• Lightweight change management and release planning for system changes.
• CAB for high-risk production/business system changes.
• For automations and integrations, IT may adopt software engineering practices (version control, testing, CI) to reduce fragility.

Scale or complexity context

• Common scale bands for this role:
• 500–2,000 employees: IT transitions from reactive support to service ownership and governance.
• 2,000–10,000 employees: specialization, global operations, stronger compliance, and deeper vendor management become essential.
• Complexity drivers include global offices, M&A, regulatory obligations, and distributed contractor populations.

Team topology

A typical VP of IT organization (varies by size): – IT Operations / Service Desk: frontline support, request fulfillment, knowledge base. – Endpoint & Collaboration Engineering: device management, collaboration suite administration, endpoint security baseline. – IAM / IT Security Engineering (IT-owned aspects): SSO integrations, lifecycle automation, access governance operations (in partnership with Security). – Enterprise Applications / Business Systems: CRM/ERP/HRIS admin and delivery teams (sometimes split across IT and functional ops). – Network & Workplace Technology (optional): office network, conferencing rooms, connectivity. – PMO / Delivery Management (optional): portfolio tracking and cross-functional program delivery.

12) Stakeholders and Collaboration Map

Internal stakeholders

• CEO/COO (often): expects operational stability, scalability, and risk management; may be escalation point for major incidents.
• CFO: IT budget governance, vendor spend control, audit needs, financial systems reliability.
• CIO (if present): may be direct manager; aligns enterprise IT strategy, architecture, and governance.
• CTO/VP Engineering: dependency on identity, access, developer tooling, collaboration, and incident practices.
• CISO/Head of Security: shared ownership across controls; coordinated incident response; audit readiness and vendor risk.
• CHRO/People Ops: onboarding/offboarding automation, HRIS integrations, device policy, employee experience.
• Legal/Compliance: contract terms, privacy, retention/eDiscovery needs, audit coordination.
• RevOps/Sales Ops: CRM changes, reliability, workflow governance, reporting accuracy.
• Finance Systems: ERP/billing workflows, access controls, SOX readiness where relevant.
• Facilities/Workplace (if separate): office buildouts, conference rooms, physical access system integrations.

External stakeholders

• Strategic SaaS vendors and managed service providers (MSPs)
• Hardware resellers and logistics providers for global device shipping
• Auditors and assessors (SOC 2/ISO/SOX)
• Telecommunications/ISP providers for offices

Peer roles

• VP of Security / CISO (peer partnership critical)
• VP of Engineering / Infrastructure / Platform
• VP of Business Systems (if split out from IT)
• VP of Data/Analytics (for governance and access patterns)
• VP of Finance Ops / Controller (for ERP reliability and controls)

Upstream dependencies

• HRIS as the authoritative source for joiner/mover/leaver events
• Procurement processes for purchasing tools/devices
• Security policies and risk frameworks (data classification, acceptable risk thresholds)
• Engineering release calendars for integrated systems

Downstream consumers

• All employees (primary consumers of IT services)
• Sales, Marketing, Support, and Finance operations teams relying on enterprise apps
• Leadership teams requiring reporting, audit readiness, and stable operations

Nature of collaboration

• Co-design: IT and Security co-design controls and enforcement to balance risk and productivity.
• Service owner model: business functions own outcomes and requirements; IT owns platform reliability, governance, and enablement.
• Steering committees: joint prioritization and funding for cross-functional initiatives.

Typical decision-making authority

• VP of IT makes day-to-day operational decisions and sets IT standards within approved governance.
• Cross-functional prioritization for enterprise systems often requires steering committee alignment (IT + functional owners + Finance).

Escalation points

• Major incidents impacting revenue-critical systems: escalate to COO/CIO/CTO and CISO depending on nature.
• Material security events: escalate to CISO immediately; coordinate communications.
• Budget overruns or significant contract risk: escalate to CFO/Procurement leadership.

13) Decision Rights and Scope of Authority

Decisions the VP of IT can typically make independently

• IT operational process standards (incident/problem/change/request) and service desk operating procedures.
• IT policy enforcement mechanisms (within approved security policy boundaries), such as device compliance gates and standard configurations.
• Prioritization within the approved IT portfolio and discretionary budget.
• Tool configuration standards and administrative controls for collaboration tools, device management, and ticketing.
• Vendor performance management actions: escalations, QBR agendas, operational remediation expectations.
• Hiring decisions within approved headcount plan (often with HR and finance controls).

Decisions requiring team approval or cross-functional alignment

• Changes that materially affect employee experience company-wide (email migration, MFA policy changes, device restrictions).
• SaaS tool selection that impacts multiple departments (collaboration suite, enterprise-wide workflow platforms).
• Data retention/eDiscovery settings that involve Legal/Compliance.
• Changes to access governance that impact Security’s control framework.

Decisions requiring executive approval (manager or executive level)

• Annual IT budget, major contract commitments, and multi-year agreements above threshold.
• Significant restructuring or headcount increases.
• Major architecture shifts with high business risk (IdP change, collaboration suite migration, core CRM replacement).
• Risk acceptance decisions for exceptions that materially increase company exposure (e.g., allowing unmanaged devices for privileged roles).
• Outsourcing/managed service provider selection where it changes operating model.

Budget, architecture, vendor, delivery, hiring, compliance authority

• Budget authority: Owns IT budget planning; approval limits vary by company policy.
• Architecture authority: Owns corporate IT architecture standards; coordinates with enterprise architecture (if present) and Security for control alignment.
• Vendor authority: Leads vendor selection and renewal proposals; coordinates with Procurement/Legal for contracting.
• Delivery authority: Accountable for IT roadmap execution and service delivery outcomes.
• Hiring authority: Accountable for building the IT org; ensures role clarity, leveling, and capability coverage.
• Compliance authority: Accountable for IT-owned controls evidence and operational compliance; partners with GRC for oversight.

14) Required Experience and Qualifications

Typical years of experience

• 15+ years in IT, enterprise systems, or technology operations roles.
• 7+ years leading managers/teams, with increasing scope (multi-team leadership; budget ownership; vendor management).
• Experience scaling IT through high-growth phases (e.g., 300 → 1,000+ employees) is highly valued.

Education expectations

• Bachelor’s degree in Information Systems, Computer Science, Engineering, or related field is common.
• Equivalent experience is often acceptable, especially for candidates with strong operational and leadership track records.
• MBA or relevant graduate degree is Optional (context-specific; more common in large enterprises).

Certifications (Common, Optional, Context-specific)

• ITIL Foundation or higher (Common/Optional): Useful for ITSM maturity; not mandatory but often beneficial.
• CISSP (Optional): Helpful where IT also has substantial security ownership; not required if a strong CISO partnership exists.
• CISM (Optional): Useful for governance and control alignment.
• COBIT (Context-specific): Helpful in highly governed/regulated enterprises.
• Cloud certifications (AWS/Azure/GCP) (Optional): Useful when IT overlaps cloud platform services.

Prior role backgrounds commonly seen

• Director of IT / Head of IT
• Senior Director of IT Operations / Enterprise Technology
• Director of Business Systems (then broadened to full IT)
• Infrastructure & Operations leader transitioning to broader corporate IT
• IT program leader with strong ITSM and enterprise systems track record

Domain knowledge expectations

• SaaS-first enterprise tooling, identity-led security, and distributed workforce enablement.
• Understanding of audit/control environments relevant to software companies (SOC 2, ISO 27001; SOX as applicable).
• Vendor contracting, service credits, and negotiation fundamentals.
• Experience with enterprise systems dependencies (CRM/ERP/HRIS) and cross-functional delivery dynamics.

Leadership experience expectations

• Proven ability to lead multiple teams with managers, not just individual contributors.
• Demonstrated executive influence: presenting roadmaps, negotiating priorities, and managing incidents with senior stakeholders.
• Track record building durable processes without excessive bureaucracy.

15) Career Path and Progression

Common feeder roles into VP of IT

• Director / Senior Director of IT
• Director of IT Operations (then broadened to apps and governance)
• Director of Enterprise Applications / Business Systems (then broadened to full IT services)
• Head of Workplace Technology / Corporate Engineering (in tech-forward orgs)
• IT Program/Transformation Director with demonstrated operating model wins

Next likely roles after VP of IT

• CIO (especially in organizations where IT includes enterprise architecture, data governance, and broader technology strategy)
• SVP of IT / Enterprise Technology (larger enterprises)
• VP/SVP of Enterprise Systems (if specializing in business applications at scale)
• COO (less common, but possible when the role demonstrates broad operational leadership)

Adjacent career paths

• Security leadership (e.g., moving into a Deputy CISO role), especially if the VP of IT has deep IAM and controls experience.
• Business systems leadership (RevOps/Finance Systems) for leaders with strong enterprise apps background.
• Transformation/operational excellence leadership across the company (process + systems + governance).

Skills needed for promotion

• Board-level communication of risk, controls, and investment decisions.
• Demonstrated capability to scale globally, integrate acquisitions, and drive enterprise-wide standardization.
• More sophisticated financial management (multi-year planning, scenario modeling, portfolio governance).
• Stronger enterprise architecture and data governance influence (not necessarily hands-on, but outcome-driven).

How this role evolves over time

• In growth stages, the role shifts from “fix and stabilize” to “standardize and scale,” then to “optimize and innovate.”
• The VP of IT typically moves from direct operational involvement to governance, talent development, and strategic enablement—ensuring the organization can run without executive heroics.

16) Risks, Challenges, and Failure Modes

Common role challenges

• Shadow IT and SaaS sprawl driven by speed needs and decentralized purchasing.
• Balancing security controls with productivity (overly restrictive policies cause bypass behavior).
• High interrupt load (incidents + requests) crowding out strategic roadmap delivery.
• Ambiguous ownership boundaries between IT, Security, and Engineering (especially for IAM, logging, and device security).
• Technical debt in integrations (fragile scripts, manual workflows, unclear data owners).
• Global scaling friction: device logistics, time zones, local compliance needs, inconsistent support coverage.

Bottlenecks

• Over-centralized approvals (VP becomes the bottleneck for access, purchases, changes).
• Weak service catalog and unclear ownership leading to slow escalation and repeated debates.
• Under-investment in automation and self-service causing linear headcount growth.
• Poor vendor management resulting in slow support, weak escalation, and renewal surprises.

Anti-patterns

• Ticket-driven leadership: measuring activity rather than outcomes, neglecting root causes and systems improvements.
• Tool-first strategy: buying platforms without operating model maturity, adoption planning, or governance.
• Over-engineered process: heavy CAB bureaucracy that slows delivery without reducing risk.
• Security theater: controls that look strong but are poorly enforced or constantly bypassed.
• Hero culture: reliance on a few individuals for critical knowledge and incident response.

Common reasons for underperformance

• Inability to influence executive peers or negotiate priorities; IT becomes reactive and undervalued.
• Lack of financial rigor: uncontrolled renewals, poor license management, and budget overruns.
• Weak incident management discipline: repeated outages and slow recoveries without systemic improvement.
• Failure to standardize identity and device posture, leading to preventable security incidents.

Business risks if this role is ineffective

• Material productivity drag across the company (slow onboarding, frequent outages, inefficient support).
• Increased likelihood of security incidents (phishing compromise, ransomware, data leakage via unmanaged SaaS).
• Audit failures or delayed certifications impacting enterprise sales and customer trust.
• Uncontrolled SaaS spend and contract risk (auto-renewals, unfavorable terms, duplicative tools).
• Poor scalability leading to operational breakdown during growth or M&A.

17) Role Variants

By company size

• Startup (≤ 300 employees):
• VP of IT may be hands-on; often builds foundational ITSM, device management, and identity quickly.
• May also own business systems directly (CRM admin, basic integrations).

• Focus: establish standards, reduce chaos, enable rapid hiring.

• Mid-market (300–2,000 employees):

• Clear separation of service desk, endpoint, IAM, and enterprise apps emerges.
• Strong emphasis on governance, vendor management, and audit readiness.

• Focus: scale reliably, reduce shadow IT, build predictable operations.

• Enterprise (2,000+ employees):

• More specialization and formal governance (ServiceNow, IT architecture boards).
• Greater compliance complexity (SOX, regional requirements).
• Focus: global standardization, portfolio management, layered support models, and resilience.

By industry

• Pure-play SaaS: heavy reliance on SaaS tooling; SOC 2 and enterprise customer requirements drive control maturity.
• Fintech/Healthtech: stronger compliance, stricter access governance, more rigorous audit and evidence automation.
• B2C tech: higher scale of support tooling and identity complexity; may require stronger fraud/abuse and privacy governance alignment (often Security/Privacy-led).

By geography

• Single-region: simpler procurement, support coverage, and compliance.
• Multi-region/global: device logistics, regional data handling norms, and multi-language support considerations become major; requires follow-the-sun coverage or strong MSP.

Product-led vs service-led company

• Product-led: IT focuses on internal productivity and governance; Engineering owns customer infrastructure.
• Service-led / IT services organization: VP of IT may also manage internal delivery systems, utilization tooling, and stronger process governance; may overlap with internal PMO.

Startup vs enterprise operating style

• Startup: speed and pragmatism; fewer committees; more direct execution; heavy emphasis on establishing “minimum viable governance.”
• Enterprise: formal controls, layered approvals, detailed documentation; strong segmentation of duties.

Regulated vs non-regulated environment

• Non-regulated: focus on productivity and cost control; controls still needed but less heavy.
• Regulated (SOX/PCI/HIPAA-like environments): evidence quality, segregation of duties, access reviews, and policy enforcement are more stringent; tooling for GRC/controls automation becomes more common.

18) AI / Automation Impact on the Role

Tasks that can be automated (increasingly)

• Ticket triage and routing: AI categorization, suggested assignment, auto-collection of diagnostic info.
• Knowledge article generation and improvement: AI drafts from resolved tickets and incident summaries (with human review).
• Password/access assistance: self-service access requests with policy checks; automated approvals for low-risk entitlements.
• Device compliance remediation: automated scripts/workflows to enforce encryption, patch levels, configuration drift correction.
• Monitoring and incident summarization: AI-generated incident timelines, stakeholder updates, and root-cause hypothesis prompts.
• License optimization analytics: AI-supported detection of unused licenses and anomalous spend patterns.
• Audit evidence collection: automated extraction of logs, access review artifacts, configuration snapshots.

Tasks that remain human-critical

• Risk decisions and exceptions: determining acceptable risk, documenting rationale, and communicating tradeoffs.
• Executive stakeholder influence: aligning priorities, negotiating governance, and driving adoption.
• Operating model design: defining ownership boundaries, accountability structures, and escalation models.
• Crisis leadership: incident command, decision-making under ambiguity, and cross-functional coordination.
• Talent leadership: hiring, coaching, performance management, and culture shaping.
• Vendor negotiations: contractual leverage, strategic partnerships, and escalation diplomacy.

How AI changes the role over the next 2–5 years

• The VP of IT will be expected to deliver higher service quality with flatter headcount growth by adopting automation-first service delivery.
• Service desk models will shift toward tier-0/1 automation and guided self-service, with human agents handling exceptions and complex workflows.
• IT governance will expand to include AI tool intake and usage policies (e.g., approved copilots, data exposure controls, retention implications).
• Increased focus on data boundaries and identity controls as AI tools connect across SaaS systems and access more sensitive data.

New expectations caused by AI, automation, or platform shifts

• Establish governance for AI assistants used by employees (data classification, prompt logging considerations, vendor risk).
• Implement and measure automation outcomes (deflection rate, reduced MTTR, improved onboarding time).
• Strengthen identity and device posture as the enforcement layer for safe AI usage.
• Expand IT’s partnership with Security and Legal to manage AI-related compliance and retention requirements.

19) Hiring Evaluation Criteria

What to assess in interviews

• Operating model maturity: Can the candidate describe how to build measurable services (catalog, SLOs, ownership, escalation)?
• Incident leadership: How they run major incidents, communicate, and ensure learning turns into systemic improvements.
• IAM and endpoint fundamentals: Ability to drive secure-by-default identity and device posture without creating widespread friction.
• Enterprise app governance: Approach to CRM/ERP/HRIS ownership, integrations, and cross-functional prioritization.
• Financial and vendor management: Contract negotiation experience, renewal governance, and measurable cost optimization.
• Leadership depth: Ability to lead leaders, build a bench, and create accountability without micromanagement.
• Change leadership: How they manage migrations, adoption, communications, and training.

Practical exercises or case studies (recommended)

1. 90-day assessment and roadmap case – Prompt: “You’ve joined a 1,200-person SaaS company. IT has frequent SSO issues, device compliance is inconsistent, and SaaS spend is uncontrolled. Present your 90-day plan and 12-month roadmap.” – Look for: prioritization logic, sequencing, metrics, and stakeholder plan.

2. Major incident simulation – Prompt: “Okta/Entra ID is degraded, executives are locked out, and Sales can’t access CRM. Walk through incident command, comms, and recovery.” – Look for: calm leadership, role clarity, comms structure, vendor escalation, and postmortem discipline.

3. Vendor renewal negotiation scenario – Prompt: “Your collaboration suite renewal is up 25%. Usage is uneven and Security wants additional controls. What do you do?” – Look for: leverage identification, stakeholder alignment, and realistic negotiation strategy.

4. SaaS governance design – Prompt: “Design a lightweight intake process that reduces shadow IT while staying fast.” – Look for: tiering, risk-based approvals, integration standards, and procurement alignment.

Strong candidate signals

• Has led IT through a growth phase with measurable improvements (MTTR reduction, onboarding speed, audit readiness).
• Uses metrics and service ownership models; can show dashboards they’ve run.
• Demonstrates balanced control mindset: secure but pragmatic, with automation to reduce friction.
• Clear examples of vendor wins (cost savings, improved SLAs, de-risked contracts).
• Builds strong managers and avoids hero culture; can articulate org design decisions.

Weak candidate signals

• Vague answers about outcomes (“improved IT”) without metrics or concrete mechanisms.
• Overfocus on tools rather than operating model, adoption, and governance.
• Treats Security as “someone else’s job” or, conversely, overreaches without collaboration.
• Cannot describe a disciplined incident process or relies on ad hoc heroics.
• Limited experience owning budgets and renewals.

Red flags

• Blame-oriented incident mindset; lacks postmortem and learning discipline.
• History of repeated large migrations with poor adoption or high disruption.
• Poor financial hygiene: surprised by renewals, no license governance, weak procurement partnership.
• Ignores or minimizes audit/control requirements in contexts where they are business-critical.
• Centralizes decisions excessively, becoming a bottleneck.

Scorecard dimensions (interview evaluation)

Dimension	What “meets bar” looks like	What “exceeds” looks like
IT strategy & roadmap	Coherent 12-month plan tied to outcomes	Multi-year vision with clear sequencing, ROI, and risk reduction
ITSM & operations excellence	Can run incident/change/problem processes	Builds service ownership, SLOs, and continuous improvement engine
IAM & endpoint governance	Solid baseline controls and lifecycle automation	Strong automation and measurable compliance; low exception rate
Enterprise apps & integrations	Understands ownership and governance	Strong cross-functional delivery and integration standardization
Financial & vendor management	Manages renewals and budgets predictably	Demonstrates measurable savings and improved vendor performance
Security/compliance partnership	Works effectively with CISO/GRC	Builds continuous controls and audit-ready evidence automation
Leadership & org design	Leads managers; clear accountability	Builds bench, succession, and high engagement; scalable structure
Communication & influence	Clear exec updates and stakeholder alignment	Trusted advisor; resolves conflicts and drives adoption

20) Final Role Scorecard Summary

Category	Summary
Role title	VP of IT
Role purpose	Provide secure, reliable, and scalable internal technology services and platforms that maximize employee productivity, reduce risk, and enable business growth with disciplined governance and cost management.
Top 10 responsibilities	1) Set IT strategy/roadmap and operating model 2) Own ITSM service delivery and performance 3) Lead IAM strategy (SSO/MFA/lifecycle) 4) Own endpoint lifecycle and compliance 5) Govern enterprise apps portfolio and integrations 6) Drive vendor, contract, and renewal management 7) Run major incident management and resilience planning 8) Establish SaaS governance and reduce shadow IT 9) Build executive dashboards and metrics 10) Lead and develop IT leadership team and workforce plan
Top 10 technical skills	1) ITSM (incident/problem/change/request/knowledge) 2) IAM (SSO/MFA/RBAC/conditional access) 3) Endpoint management (Intune/Jamf concepts) 4) Endpoint security baseline (patch/encryption/EDR coordination) 5) SaaS governance and app portfolio rationalization 6) Enterprise apps oversight (CRM/ERP/HRIS) 7) Vendor and contract management 8) IT financial management (budgeting/license optimization) 9) Integration literacy (SCIM/APIs/iPaaS concepts) 10) Resilience/BCP/DR planning for internal services
Top 10 soft skills	1) Executive communication 2) Stakeholder management/negotiation 3) Operational judgment under pressure 4) Internal-customer service mindset 5) Systems thinking 6) Change leadership and adoption 7) Talent leadership/coaching 8) Financial discipline mindset 9) Integrity and risk-based decision-making 10) Cross-functional collaboration
Top tools or platforms	Okta or Microsoft Entra ID; Intune and/or Jamf; Jira Service Management or ServiceNow; Microsoft 365 or Google Workspace; Slack; CrowdStrike or Defender for Endpoint; Confluence/Notion; Workato/MuleSoft (context); Salesforce (common); NetSuite/Workday (context)
Top KPIs	Core service availability (SSO/collab/CRM); MTTR/MTTA; ticket SLA attainment; first contact resolution; backlog age; employee IT CSAT; onboarding time-to-productivity; endpoint compliance and patch compliance; access review completion; SaaS spend under management and license utilization efficiency
Main deliverables	IT strategy and annual operating plan; service catalog with SLAs/SLOs; ITSM process set and dashboards; IAM standards and lifecycle automation improvements; endpoint compliance baseline; SaaS governance intake workflow; vendor scorecards/renewal calendar; resilience runbooks and incident/postmortem artifacts; audit evidence packs; knowledge base/self-service improvements
Main goals	First 90 days: stabilize key services, baseline metrics, publish roadmap and operating model. 6–12 months: materially improve reliability and support experience, reduce security/audit risk, and optimize SaaS spend with measurable savings. Long term: scalable global IT platform with automation-first delivery and high stakeholder trust.
Career progression options	CIO; SVP of IT/Enterprise Technology; VP/SVP of Enterprise Systems; broader operational leadership roles (context-dependent)