POSITION SUMMARY

The Director of Information Security will design and execute a comprehensive, scalable security program to protect customer data, infrastructure, and products. Reporting directly to the CEO, you will lead a globally distributed security and operations team, manage risk and compliance, and shape the future of security in an cloud-native environment.
You will be expected to lead aggressively with a preventive mindset, build a strong security culture, and deliver measurable results in a fast-paced, high-growth environment.

QUALIFICATIONS & EXPERIENCE

• Bachelor’s or Master’s in Computer Science, Cybersecurity, or related discipline
• 8+ years of progressive security experience, including 3+ years in a director or senior leadership role
• Proven success building and scaling security functions in fast-growing SaaS or platform environments
• Strong experience with AWS/GCP, DevSecOps principles, container security, and cloud-native tooling
• Deep familiarity with security frameworks: NIST 800-53, ISO 27001, SOC 2, FedRAMP
• Experience leading or partnering with GRC, DevOps, and engineering to embed security across the SDLC
• Demonstrated leadership in high-growth, goal-oriented environments

DESIRED SKILLS & ATTRIBUTES

• CISSP, CISM, or equivalent certification
• Proficiency in automating security workflows using Python, Terraform, or orchestration tools
• Experience with red/blue team coordination and breach simulation
• Ability to lead and inspire multicultural, distributed teams across time zones
• Strong communication and executive influence skills; ability to align stakeholders on risk priorities
• Strategic thinker with a bias for action, accountability, and innovation

• Define and lead the company’s global information security strategy and roadmap
• Develop and enforce security policies, standards, and procedures aligned with business objectives and compliance obligations
• Lead regular risk assessments across infrastructure, application, and network layers
• Ensure early involvement in the product lifecycle to embed “secure by design” practices