Director, Security and Compliance

Job Overview

The Director of Security and Compliance is a strategic, highly technical leader responsible for designing, scaling, and overseeing our global information security and regulatory compliance programs. Reporting to the CIO, this role bridges the gap between technical security engineering, legal requirements, and business operations. Key responsibilities include defining our security posture, leading Governance, Risk, and Compliance (GRC) initiatives, and ensuring continuous alignment with industry frameworks.

The ideal candidate for this role is someone who doesn't just manage checklists but actively translates complex regulatory policies into practical, testable technical controls that allow our engineering and business teams to move fast without losing control.

Core Responsibilities

• Governance, Risk & Compliance (GRC) Strategy
• Framework Management: Lead the strategy, implementation, and continuous monitoring of core security frameworks relevant to our business (e.g., SOC 2, ISO 27001, NIST CSF, PCI DSS, HIPAA).
• Data Privacy Adherence: Partner closely with Legal counsel to ensure corporate compliance with global data privacy regulations (e.g., GDPR, CCPA/CPRA).
• Risk Management: Design and execute regular enterprise risk assessment programs. Identify vulnerabilities, prioritize risks based on business impact, and collaborate with department heads on remediation plans.
• Policy Architecture: Draft, update, and enforce company-wide information security policies and procedures, ensuring they adapt to evolving engineering workflows (like CI/CD pipelines and infrastructure-as-code).
• Security Operations & Oversight
• Security Posture Optimization: Your Security Engineering team will partner with the IT Infrastructure team to monitor infrastructure security, access controls (IAM), and data encryption protocols.
• Incident Response: Serve as a key leader on the Incident Response Team, helping to orchestrate investigations, mitigation efforts, and required regulatory disclosures in the event of a breach.
• Third-Party Risk Management (TPRM): Oversee the security vetting process for vendors, software tools, and supply chain partners to minimize external risk exposure.
• Audit & Stakeholder Management
• Audit Readiness: Manage all external and internal security audits, coordinate evidence collection, manage relationships with auditors, and reduce duplicate controls across overlapping frameworks.
• Customer & Sales Enablement: Act as the face of the company's security posture for enterprise clients. Review security questionnaires, participate in prospective client calls, and help build trust to accelerate the sales cycle.
• Executive Reporting: Translate highly complex technical data into concise business metrics for executive leadership and the Board of Directors, keeping them informed of our overall risk landscape.
• Leadership & Culture
• Team Development: Recruit, mentor, and manage a team of security analysts and compliance professionals.
• Security Training: Develop and deliver engaging, modern security awareness training programs that foster a culture of vigilance across all business units.

Required Qualifications & Experience

• Education: BS/MS degree in Computer Science, Information Systems, Cybersecurity, Business, or equivalent practical experience.
• Experience: Minimum of 10 years of experience in information security, risk management, or compliance roles, with at least 5 years in a dedicated leadership or managerial capacity.
• Cloud & Tech Savvy: Strong familiarity with AWS or similar cloud environments and modern compliance automation platforms (e.g., Vanta, Drata, Anecdotes).
• Framework Fluency: Proven experience in successfully achieving and maintaining certifications such as SOC 2 Type II or ISO 27001 from the ground up.
• Certifications: One or more relevant industry certifications are highly preferred (e.g., CISSP, CISM, CISA, CRISC, or CIPP).
• Communication Style: Superb verbal and written communication skills. You must be equally comfortable diving deep into log management with engineers and explaining corporate risk to a non-technical board.