A director position is a managerial role, not a security engineering role, moreover a director is typically a manager of other managers, who in this case has at least one more security manager above them before the change. I am not a fan of measuring a firm's commitment to security engineering by counting the number of managers in this role, rather than looking at the quantity and quality of engineers. This could be a flattening of a hierarchy or it could be something else.