Lead, System Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop Slate's cybersecurity strategy, establish a multi-year roadmap, set risk-based priorities, create a security policy framework, maintain a risk register, and design a governance model.

• Communicate security posture and risks to the CTO, executive team, and board members.

• Manage the security budget effectively.

• Oversee compliance and regulatory preparedness across SOX IT general controls, NIST CSF 2.0, ISO 27001, PCI-DSS, CCPA and state privacy laws, NIST 800-171, CMMC, and export control obligations.

• Ensure audit readiness, collect evidence, and track remediation efforts.

• Recruit, lead, and nurture the security team.

• Implement security awareness and training initiatives.

• Develop vehicle and product cybersecurity capabilities, including TARA, secure over-the-air updates, telematics and backend security, key and certificate management, and supplier cybersecurity requirements.

• Create product security incident response and coordinated vulnerability disclosure programs.

• Integrate security into the SDLC for consumer web, ecommerce, mobile, B2B integrations, and internal applications.

• Set standards for threat modeling, secure code review, SAST/DAST, dependency and secrets management, and cloud security posture across AWS, Azure, and edge platforms.

• Lead penetration testing and prioritize remediation efforts.

• Secure ERP, WMS, procurement, warranty, and other enterprise systems.

• Manage role design, segregation of duties, privileged access, and conduct access reviews.

• Establish an OT security program for the Warsaw plant and future locations aligned with IEC 62443 standards.

• Oversee identity and access management, endpoint and email security, vulnerability management, and corporate security architecture.

• Define data classification, retention, and protection standards, along with privacy-by-design controls and safe-use guidelines for AI and LLM tools.

• Manage detection, response, threat intelligence, incident response planning, crisis communications, legal coordination, and regulatory notifications.

• Develop a third-party and supply-chain security risk management program.

• Collaborate with teams across Technology, vehicle engineering, manufacturing, legal, compliance, finance, internal audit, supply chain, and customer care.

⛳️ Requirements

• Over 10 years of experience in information security or cybersecurity.

• Minimum of 5 years in leadership roles overseeing security teams or programs.

• Proven experience in building or significantly enhancing a security program across various domains.

• Hands-on leadership in compliance initiatives related to SOX IT general controls and at least one of ISO 27001, NIST CSF, SOC 2, or NIST 800-171.

• Experience with actual audits and obtaining certifications.

• Direct experience securing manufacturing, industrial, or OT environments, or comprehensive knowledge of IEC 62443, OT network segmentation, and production-floor realities.

• Strong technical expertise in cloud security, identity and access management, application security, and security operations.

• Ability to assess architecture and challenge vendors effectively.

• Proven ability to translate risk into business terms and make sensible, prioritized trade-offs.

• Excellent written and verbal communication skills, including the ability to present to executives and boards.

• A low-ego, collaborative approach to cross-departmental work.

• Candidates must have authorization to work permanently in the United States.

• Experience in automotive, EV, or connected product security, including ISO/SAE 21434, UN R155/R156, or a Cybersecurity Management System is preferred.

• Experience establishing security for a greenfield plant, a new company, or a rapidly scaling organization is preferred.

• Knowledge of consumer ecommerce and payments security, including PCI-DSS scoping and consumer privacy regulations is preferred.

• Familiarity with CMMC, ITAR/EAR, or government and defense contracting requirements is preferred.

• Experience in securing data platforms and AI/ML or LLM-based applications is preferred.

• Relevant industry certifications such as CISSP, CISM, GICSP, or CCSP are preferred.

• A Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience is preferred.

🏝️ Benefits

• Medical insurance

• Dental insurance

• Vision insurance

• Life insurance

• Disability insurance

• Vacation

• 401k

• Eligibility for equity program

• Eligibility for discretionary annual incentive program

• Reasonable accommodations for qualified individuals with disabilities