Remote Director, Security and Compliance

The Company You’ll Join At Rebuy, we're on a mission to revolutionize shopping with intelligent, personalized experiences that wow customers around the globe. As a fully remote team, we power some of the fastest growing DTC brands like Tecovas, Momofuku, Dime Beauty, Liquid Death, Magic Spoon, OLLY, and many more. We don’t just build great tech - we build lasting partnerships, a strong community, and a place where people love to work. Rebuy is looking for a senior, hands-on leader to own security, compliance, privacy, and IT across the company. Reporting to the COO and briefing the executive team quarterly, you'll lead our compliance programs, protect our cloud infrastructure and applications, manage privacy and data governance, and keep our people and systems secure and productive. You'll set direction and drive security initiatives in partnership with our DevOps and Engineering teams. Governance, Risk and Compliance Lead Rebuy's compliance programs, including SOC 2 Type 2 (Security, Availability, Confidentiality), GDPR, CCPA/CPRA, and Shopify partner security requirements, through audits and third-party assessments. Own company security policies, risk management, and vendor risk management. Maintain our Trust Center and support Sales with customer security reviews and questionnaires. Lead security awareness training and the security side of personnel lifecycle processes. Support cyber insurance applications and renewals. Business Continuity and Resilience Own business continuity and disaster recovery planning, including regular testing and validation. Privacy and Data Governance Own the data governance program and Rebuy's privacy documentation, including the privacy policy, DPA, subprocessor list, and vulnerability disclosure policy. Manage data subject requests and the automated processes that support them. Review new products, partnerships, and data-sharing arrangements for privacy and security impact. Review customer and vendor agreements for privacy and security terms in partnership with Legal. Help shape AI governance that supports Rebuy's open approach to AI tools while protecting company and customer data. Security Operations and Incident Response Own the incident response program, lead response to security incidents, and coordinate customer and regulatory notifications with Legal. Run vulnerability management across cloud, code, and endpoints, driving remediation with owning teams. Manage annual penetration testing from scoping through remediation. Partner with DevOps on CI/CD, deployments, and infrastructure so security is built in from the start. Application and Cloud Security Set application security standards and drive adoption across Engineering. Lead security initiatives such as authentication, logging, and monitoring alongside DevOps and Engineering. Define secrets management standards. Secure our cloud environment, including identity and access, network controls, and monitoring of sensitive data. Own email, domain, and DNS security. IT Operations and Systems Administration Manage the company's endpoint fleet, including device management, configuration baselines, patching, and hardware procurement and fulfillment for a remote workforce. Administer and secure the company's SaaS platforms. Provide IT support to employees. Leadership and Budget Management Report quarterly to executive leadership on security, risk, and compliance. Own tooling and budget decisions for a significant portion of the technology stack, including monitoring cloud spend. Serve as the company's trusted advisor on security and compliance. 8+ years in security and GRC, including end-to-end ownership of a SOC 2 Type 2 program. ~ Hands-on experience securing a major cloud environment (GCP preferred). ~ Working knowledge of GDPR, CCPA/CPRA, and data governance practices. ~ Experience with compliance automation, cloud security, and macOS device management tools (e.g., Experience administering and securing a broad SaaS environment, including identity and access management. ~ Experience building and testing BCP/DR plans and running incident response exercises. ~ Application security fluency (e.g., OWASP Top 10, SAST, CI/CD, secrets management) sufficient to set standards and partner credibly with engineers. ~ Ability to influence without authority and communicate risk to executives in business terms. ~ Self-direction in a fast-moving, fully remote environment. You prioritize ruthlessly, document thoroughly, and automate where you can. ~ Rebuy is a fully remote company across the U.S. and Canada that aims to provide all of our team with the resources, support and flexibility they need to thrive in their roles. Remote Work: With a strong internet connection, you’re able to work from anywhere within the U.PTO : We offer a flexible vacation policy, generous holiday schedule, parental leave and sick policy. There’s other policies too like a birthday holiday! Amazing Benefits: 100% free health, dental, and insurance for you and your family. Retirement Plans : For our U.S. employees we offer 401(k) retirement plans and for our Canadian employees we offer a TFSA and RRSP retirement plans. Your recruiter and hiring manager can share more about the specific salary range for the job location during the hiring process. We do not discriminate based on gender, race or color, ethnicity or national origin, age, disability, religion, sexual orientation, gender identity or expression, veteran status, or any other applicable characteristics protected by law. If you have a disability or special need that requires accommodation to navigate our website or complete the application process, email View email address on click.appcast.io.