Director of Information Security

We're looking for a hands-on, detail-oriented Information Security Director to take ownership of leading both our internal Information Security and Information Systems. In this role, you'll lead the implementation and management of our security operations, policies, and compliance processes. You'll work cross-functionally to ensure our systems, data, and employees follow best practices and meet relevant regulatory requirements.

This is a foundational role for our security efforts-ideal for someone who enjoys building systems, and shaping policies and driving automation in a fast-paced environment.

Key Responsibilities

• Maintain and continuously improve the company's information security practices, tools, and procedures.
• Monitor internal systems for vulnerabilities or breaches, and lead incident response efforts when necessary.
• Develop, implement, and enforce security policies, standards, and procedures across the organization.
  Lead and manage compliance initiatives related to frameworks such as SOC 2, ISO 27001, ISO 42001, and GDPR.
• Conduct internal risk assessments and coordinate third-party audits, ensuring timely remediation of findings.
• Oversee identity and access management (IAM), ensuring least-privilege principles are applied and maintained.
• Provide security training and awareness programs to employees across all departments.
• Evaluate and manage the security posture of third-party vendors and cloud services.
• Collaborate with engineering and IT teams to embed security best practices into systems and workflows.
• Stay current with emerging threats, technologies, and regulatory changes that may impact the company's security posture.
• Build and lead a dedicated team to execute and scale security and information systems processes.
• Collaborate across the organization to drive automation and enhance security maturity in both product security and information security.
• Work closely with platform teams to support and enable organizational growth.

Qualifications

• 7+ years of hands-on experience in information security, IT security, or a related field.
  Familiarity with common security and compliance frameworks (SOC 2, ISO 27001, NIST, GDPR, etc.).
• Strong understanding of modern IT infrastructure (cloud services, SaaS, access controls, security architecture, etc.).
• Excellent communication skills-you can translate complex security concepts for non-technical teams.
• Experience in managing teams and driving cross functional projects.
• Experience in a startup or small company environment is a plus.

Nice to Have

• Relevant certifications (e.g., CISSP, CISM, CompTIA Security+, ISO 27001 Lead Implementer).
• Exposure to secure software development practices (DevSecOps, secure SDLC, etc.).
• Experience in security operations and/or incident response.