Director of Cybersecurity

This is a fully remote position, open to applicants in Washington.

📋 Description

• Develop and implement Slate's cybersecurity strategy, including a multi-year roadmap and risk-based priorities.

• Manage the security policy framework, risk register, governance model, and security budget effectively.

• Provide updates on security posture and risks to the CTO, executive team, and board members.

• Oversee compliance and regulatory preparedness for SOX IT general controls, NIST CSF 2.0, ISO 27001, PCI-DSS, CCPA, and state privacy laws, NIST 800-171, CMMC, and export control obligations.

• Ensure audit readiness by managing evidence collection and tracking remediation efforts.

• Recruit, lead, and foster the development of the security team.

• Implement security awareness and training initiatives.

• Create a vehicle cybersecurity management system in accordance with ISO/SAE 21434 and UN R155/R156 standards.

• Conduct threat analysis and risk assessments, ensuring secure over-the-air updates, telematics, backend security, key and certificate management, and supplier cybersecurity compliance.

• Develop product security incident response and coordinated vulnerability disclosure strategies.

• Integrate security into the Software Development Life Cycle (SDLC) for websites, ecommerce, mobile applications, B2B integrations, and internal systems.

• Establish standards for threat modeling, secure code reviews, SAST/DAST, dependency and secrets management, and cloud security across AWS, Azure, and edge platforms.

• Drive penetration testing initiatives and prioritize remediation efforts.

• Secure ERP, WMS, procurement, warranty, and other enterprise applications.

• Define role design standards, segregation of duties, privileged access management, and conduct access reviews.

• Implement an OT security program for the Warsaw plant and forthcoming sites, focusing on network segmentation, asset inventory, secure remote/vendor access, OT monitoring, and incident response protocols.

• Manage identity and access management, endpoint and email security, vulnerability management, and corporate security architecture.

• Establish data classification, retention, protection, privacy-by-design, and AI/LLM security measures.

• Supervise detection, response, and threat intelligence across IT, cloud, OT, and vehicle environments.

• Develop and practice incident response plans, including crisis communication, legal coordination, and regulatory notification processes.

• Create a vendor security risk program for SaaS providers, MSPs, integration partners, component suppliers, and contract manufacturers.

• Collaborate with leaders in Technology, vehicle engineering, manufacturing, legal, compliance, finance, internal audit, supply chain, and customer care.

⛳️ Requirements

• A minimum of 10 years in information security or cybersecurity.

• At least 5 years of experience in leading security teams or programs.

• Proven experience in building or significantly enhancing a security program across various domains.

• Hands-on leadership experience with compliance efforts against recognized frameworks, including SOX IT general controls and at least one of ISO 27001, NIST CSF, SOC 2, or NIST 800-171.

• Practical experience with audits and certifications.

• Direct experience securing manufacturing, industrial, or OT environments, or a robust understanding of IEC 62443, OT network segmentation, and production-floor realities.

• Strong technical foundation in cloud security, preferably AWS, as well as identity and access management, application security, and security operations.

• A history of translating risk into business language and making pragmatic, prioritized decisions.

• Excellent written and verbal communication skills, including the ability to present to executives and board members.

• A low-ego, collaborative mindset when working across departments.

• Preferred experience in automotive, EV, or connected product security.

• Familiarity with ISO/SAE 21434, UN R155/R156, or a Cybersecurity Management System is preferred.

• Experience establishing security for a greenfield plant, a new company, or a rapidly growing business is preferred.

• Knowledge of consumer ecommerce and payments security, including PCI-DSS scoping and consumer privacy regulations, is preferred.

• Familiarity with CMMC, ITAR/EAR, or government and defense contracting requirements is preferred.

• Understanding of securing data platforms and AI/ML or LLM-based applications is preferred.

• Relevant industry certifications such as CISSP, CISM, GICSP, or CCSP are preferred.

• A Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience is preferred.

• Must be authorized to work in the United States on a permanent basis.

• Visa sponsorship is not available.

🏝️ Benefits

• Medical insurance

• Dental insurance

• Vision insurance

• Life insurance

• Disability insurance

• Vacation

• 401k

• Potential eligibility for equity program

• Potential eligibility for discretionary annual incentive program

• Reasonable accommodations for qualified individuals with disabilities