As the Director of Information Security and GRC, you will oversee all aspects of our company's information security program, ensuring the protection of our data, systems, employees, and applications. You will lead a team of talented security professionals, driving a proactive, responsive and comprehensive security posture aligned with industry best practices and regulations.
Responsibilities:
Be kind.
Will be leading a team of 3-4 security operations specialists and engineers.
Embody the organizations values and act as a values champion, holding both yourself and others accountable to them.
Develop and implement a comprehensive information security strategy aligned with business objectives and risk tolerance.
Lead the Security team, fostering a culture of transparency, continuous improvement and collaboration.
Lead the development and implementation of IT governance frameworks and policies.
Oversee the implementation and maintenance of security controls, including firewalls, intrusion detection/prevention systems, and endpoint security solutions.
Manage product security, vulnerability management, and incident response processes.
Design and implement a robust Governance, Risk, and Compliance (GRC) program, ensuring companywide adherence to relevant regulations and standards.
Conduct regular security assessments and risk analyses to identify and mitigate potential vulnerabilities, partnering with business units and stakeholders across the organization.
Ensure that the organization is prepared for internal and external IT audits; and manage the audit process.
Coordinate with external agencies, auditors, customers and stakeholders for compliance assessments and audits.
Assist in the selection, implementation, and maintenance of security technologies, tools, vendors, and processes to ensure adherence to the organization's security policies and goals.
Work with DevOps and the development staff to improve the security posture and to implement secure SDLC practices.
Stay up to date on the latest security threats, trends, and technologies, ensuring that our company adopts appropriate countermeasures.
Develop and deliver security awareness training programs for employees.
Manage the security budget and resources effectively.
Report to the Chief Operating Officer (COO) on the organization's overall security posture.
Curate the organizations risk register and report regularly on burndown.
Requirements: 7+ years of experience in the information security leadership, GRC, and product security spaces.
5+ years of experience in leading and managing security teams.
Proven track record of building and implementing successful security programs.
Proven knowledge of IT GRC frameworks such as COBIT, ISO 27001, NIST, etc.
Experience building and operating a security incident response program.
Experience building a SSDLC framework and driving adoption within SWE teams.
Ability to build meaningful partnerships across diverse geographies and cultures.
Strong understanding of product security best practices and industry standards.
Excellent communication, presentation, and interpersonal skills.
Ability to work effectively in a global environment, and experience with international customers.
Relevant security certifications (e.g., CISSP, CISO, CISA, CISM) a plus.
Strong analytical and problem-solving skills.
If your experience is close but doesnt fulfill all requirements, please apply. we are on a mission to build a special company comprised of individuals with different backgrounds, perspectives, and experiences.
This position is open to all candidates.