Director of Information Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Take full ownership of Fetch's security function from start to finish, encompassing vulnerability management, AppSec, incident response and forensics, security architecture, GRC/compliance, third-party risk, and security awareness.

• Manage the daily implementation of the security function while mitigating high-impact security risks.

• Develop a robust, auditable, and scalable security program that includes policies, controls, evidence, and reporting mechanisms.

• Lead and nurture the Security team.

• Act as the primary technical authority and incident commander during security incidents.

• Represent Information Security to executives, auditors, customers, and partners.

• Oversee the AppSec and vulnerability management program, which includes Snyk, CI/CD security gating, and repository risk classification.

• Drive SLAs for vulnerability remediation and take a proactive approach to prevention.

• Coordinate incident response efforts, containment strategies, communication, post-incident reviews, and root-cause analyses.

• Manage bug bounty programs and continuous penetration testing disclosure processes.

• Conduct security architecture reviews for new systems, platforms, and AI agent deployments.

• Uphold security standards for cloud infrastructure, endpoint protection, and network/edge security.

• Collaborate with IT Operations on identity-related risks and access governance.

• Take charge of security policies, risk registers, and control frameworks; lead audits and assessments.

• Communicate program maturity, existing risks, and remediation progress to executive leadership.

• Work alongside the Chief AI Officer on AI governance, enforcement of acceptable-use policies, and risks associated with AI tooling.

• Provide security reviews and risk approvals for AI platforms, agents, and integrations.

• Manage vendor and third-party security risk assessments.

• Spearhead company-wide security awareness initiatives, including phishing simulations and targeted training programs.

• Recruit, mentor, and develop the Security Engineering team; establish priorities and manage performance.

• Create team operating rhythms, including on-call/incident rotation, backlog grooming, and technical review protocols.

• Produce regular executive security reports and represent Information Security in cross-functional discussions.

⛳️ Requirements

• Minimum of 7 years in information security, with significant experience in application security, incident response, and security architecture.

• Proven experience managing vulnerability management programs at scale, utilizing tools like Snyk or similar.

• Direct experience in incident command, coordinating cross-functional responses to major security incidents.

• Experience in people management, particularly in building or expanding a security engineering team.

• Familiarity with cloud security, identity and access management concepts, and modern AI/agent architecture risks.

• Excellent written and verbal communication skills, including the ability to present to executive audiences comfortably.

• Preferred: experience in managing bug bounty programs or responsible disclosure initiatives.

• Preferred: experience in developing or enhancing a GRC program, including familiarity with audit and compliance frameworks (SOC 2, ISO 27001).

• Preferred: knowledge of AI agent security risks, including MCP-style tool/agent architectures and identity delegation patterns.

• Preferred: experience collaborating with AI governance or data governance teams.

• Preferred: relevant certifications such as CISSP or CISM.

• Skills in incident command and crisis leadership.

• Proficiency in security architecture and risk assessment.

• Ability to build program and process maturity.

• Competence in people leadership and coaching.

• Strong executive communication skills.

• Ability to influence cross-functional teams without direct authority.

• Good judgment under ambiguity and time constraints.

🏝️ Benefits

• Equity: full-time employees receive equity in Fetch.

• 401(k) with dollar-for-dollar matching up to 4% of eligible pay.

• Comprehensive medical, dental, and vision plans, including coverage for pets.

• $10,000 per year in education reimbursement.

• Participation in Employee Resource Groups and the Inclusion Council.

• Flexible PTO.

• 9 paid holidays.

• Year-end week-long break.

• 14 weeks of fully paid parental leave.

• 6 additional weeks of paid recovery leave for birthing parents.

• Flexible return-to-work schedule.

• One-time $2,000 Calvin Care Cash incentive for employees welcoming new family members.

• Flexible work environment; fully remote options available for US-based roles.

• Hardware and software equipment provided for home working.