Director of Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the security team, which includes responsibilities for hiring, development, performance evaluations, promotions, and compensation suggestions.

• Collaborate with the CISO to create and manage the security roadmap.

• Direct the execution of SOC 2 Type 2 attestation, covering scope, control assessment, remediation, observation period, and evidence gathering.

• Take ownership of Vanta and uphold the Customer Trust Portal alongside external security documentation.

• Manage customer security questionnaires and external evaluations.

• Set up and conduct security assessments of third-party vendors.

• Integrate controls into engineering workflows and monitor control coverage.

• Write and update security policies and standards for CISO approval.

• Prepare decisions for the CISO and ensure implementation.

• Lead the security incident response and collaborate with SRE, support, legal, and customer-facing teams.

• Oversee vulnerability management across applications, infrastructure, and dependencies.

• Establish secure design practices, threat modeling, and conduct security reviews.

• Collaborate on access control, authentication, secrets management, logging, and monitoring.

• Evaluate security and privacy implications of new capabilities, including AI-driven features.

• Educate engineers and the broader company on security best practices.

• Report security risks and advancements to leadership.

• Manage the security budget and provide recommendations on tooling and build, buy, or partnership decisions.

⛳️ Requirements

• A minimum of eight years in information security, with at least three years in a leadership role within a security team.

• Technical credibility in application security and cloud infrastructure.

• Direct experience guiding an organization through a SOC 2 Type 2 audit or a similar attestation such as ISO 27001.

• Experience leading customer security evaluations and third-party vendor risk assessments in a software environment.

• Proven experience managing responses to actual security incidents.

• Experience collaborating with a CISO or an equivalent executive responsible for security risk decisions.

• Experience working alongside engineering teams as a collaborative partner.

• Ability to communicate risks clearly and honestly to both technical and non-technical audiences.

• Experience in hiring and nurturing security professionals.

• Comfort in working with colleagues from various countries and time zones.

• Must have permanent residency in the United States; current U.S. residency is required.

• Preferred: familiarity with Vanta, Drata, or Secureframe and managing a customer-facing trust center.

• Preferred: experience leading a company through its initial SOC 2 Type 2 attestation.

• Preferred: security leadership experience in a SaaS company with multiple products or a history of acquisitions.

• Preferred: knowledge of PCI DSS.

• Preferred: expertise in student or children's data privacy, including FERPA and COPPA regulations.

• Preferred: experience in securing software across multiple cloud providers.

• Preferred: knowledge of identity and access security, including SSO and MFA implementations.

• Preferred: experience building a security program with a small team.

• Preferred: assessing security and privacy risks associated with AI-enabled products.

• Preferred: experience with K-12 or public-sector customers.

🏝️ Benefits

• Competitive benefits package.

• Opportunities for professional development.

• 100% fully remote employment options available for permanent residents of the United States.