VP, Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Develop and implement the security strategy along with a multi-year roadmap.

• Execute the security program in accordance with NIST CSF 2.0 while expanding audit scopes and certifications.

• Establish governance for AI across models, agents, and Stord Labs initiatives.

• Implement 24/7 detection and response capabilities, starting with an MDR partnership.

• Gradually transition detection engineering functions in-house.

• Manage incident response activities, including playbook development, on-call duties, tabletop exercises, and postmortem analyses.

• Design and maintain SIEM/SOAR, EDR/XDR, cloud security posture management, API security, secrets management, and vulnerability management frameworks.

• Strengthen CI/CD practices within a 200+ person engineering team.

• Oversee security diligence and integration processes for acquired firms.

• Collaborate with Product and Engineering teams to ensure secure-by-default design principles.

• Manage penetration testing initiatives and the bug bounty program.

• Act as the executive representative during enterprise security reviews and questionnaires.

• Take charge of business continuity and disaster recovery plans, including recovery testing.

• Lead and expand teams that cover GRC, security operations, security engineering, application security, and cloud/infrastructure security, along with an MDR partner.

⛳️ Requirements

• 12+ years of experience in security, including a minimum of 5 years in a leadership role within a SaaS or platform company.

• Extensive knowledge in cloud-native security at scale, particularly with AWS/GCP, Kubernetes, microservices, CI/CD, and API security.

• Capability to contribute meaningfully to architecture reviews.

• Hands-on experience in managing M&A security diligence and integration processes.

• Proven track record in developing security programs aligned with NIST CSF, SOC 2, and ISO 27001, and successfully passing audits.

• Experience in establishing or operating a 24/7 detection and response capability, whether in-house, through MDR, or in a hybrid setup.

• Strong communication skills suitable for executive and Board-level interactions.

• Sound judgment regarding security risk prioritization and investment in controls.

🏝️ Benefits

• Current SOC 2 Type II attestation for core platforms.

• Public Trust Center.

• Certification under the EU-U.S. Data Privacy Framework.

• A well-established, capable security team.