About the company
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a VP, Security based in the United States.
Responsibilities
- Define and execute the security strategy, multi-year roadmap, governance framework, and technical priorities, including alignment with NIST CSF 2.0.
- Expand security audit scopes and certifications while establishing effective governance for AI models, agents, and AI-related initiatives.
- Build and operate a scalable security operations capability, initially leveraging an MDR partner and progressively developing internal detection engineering capabilities.
- Own incident response end to end, including playbooks, on-call processes, executive tabletop exercises, investigations, postmortems, and remediation.
- Lead the security engineering stack across SIEM/SOAR, EDR/XDR, cloud security posture management, API security, secrets management, and vulnerability management.
- Strengthen software delivery security across a large engineering organization through practices such as signed commits, SBOM generation, dependency and secrets scanning, and SAST/DAST.
- Own security diligence and integration planning for acquisitions, including assessment of inherited environments, credentials, systems, technical debt, and remediation requirements.
- Partner with Product and Engineering to establish secure-by-default approaches across technology platforms and customer-facing products.
- Oversee penetration testing and bug bounty programs and act as the executive security representative in enterprise customer reviews, questionnaires, and security discussions.
- Lead business continuity and disaster recovery efforts, regularly testing recovery capabilities to validate operational resilience.
- Lead, develop, and scale a security organization spanning GRC, security operations, security engineering, application security, and cloud/infrastructure security.
- Establish effective security operating rhythms, priorities, metrics, and resource plans as the organization and business continue to scale.
Requirements
- 12+ years of professional security experience, including 5+ years leading a security function within a SaaS, technology, or platform company.
- Deep experience with cloud-native security environments, including AWS and/or GCP, Kubernetes, microservices, CI/CD, and API security.
- Strong technical credibility and the ability to participate meaningfully in architecture reviews and security engineering decisions.
- Demonstrated experience leading security diligence and integration for M&A transactions.
- Proven experience building and operating security programs aligned with frameworks and standards such as NIST CSF, SOC 2, and ISO 27001, including successful audits.
- Experience establishing or managing 24/7 security detection and response through internal teams, MDR providers, or hybrid models.
- Strong executive communication skills, with the ability to explain security risks, technical trade-offs, controls, and business implications to boards, executives, finance leaders, and engineering teams.
- Strong judgment around security investment, risk prioritization, controls, and mitigation strategies.
- Ability to lead through influence, build high-performing teams, and establish effective partnerships across technical and business functions.
- Experience operating effectively in complex, rapidly changing environments with competing priorities.
- Experience with IPO readiness, public-company security requirements, SEC cybersecurity disclosure, SOX IT controls, or board reporting is a plus.
- Experience securing operational or physical environments such as warehouses, manufacturing, robotics, OT, or IoT is advantageous.
- Experience establishing AI/ML security governance, ideally using frameworks such as the NIST AI Risk Management Framework, is a plus.
- Familiarity with international regulatory requirements such as GDPR, the EU-U.S. Data Privacy Framework, NIS2, or the EU AI Act is beneficial.
- Experience in environments where software and physical operations are closely interconnected is a plus.
Conditions
- Remote position based in the United States.
- Executive-level opportunity with broad ownership across security strategy, engineering, operations, governance, resilience, and customer trust.
- Opportunity to build and scale a security organization and operating model during a period of continued business growth.
- Significant exposure to cloud-native technology, AI, international expansion, and M&A integration.
- Opportunity to influence security architecture, product development, engineering practices, and enterprise customer relationships.
- Collaborative environment that values diversity, inclusion, and contributions from different perspectives.
- Equal opportunity employment practices and consideration without discrimination based on legally protected characteristics.
- U.S. employment authorization is required; participation in the federal E-Verify program applies.