The RoleRebuy is looking for a senior, hands-on leader to own security, compliance, privacy, and IT across the company. Reporting to the COO and briefing the executive team quarterly, you'll lead our compliance programs, protect our cloud infrastructure and applications, manage privacy and data governance, and keep our people and systems secure and productive.
This is an individual contributor leadership role. You'll set direction and drive security initiatives in partnership with our DevOps and Engineering teams. This is a great fit for someone who's comfortable as the accountable owner across many domains and can influence without formal authority.
What You'll Do:Governance, Risk and Compliance- Lead Rebuy's compliance programs, including SOC 2 Type 2 (Security, Availability, Confidentiality), GDPR, CCPA/CPRA, and Shopify partner security requirements, through audits and third-party assessments.
- Own company security policies, risk management, and vendor risk management.
- Run periodic access reviews across company systems.
- Maintain our Trust Center and support Sales with customer security reviews and questionnaires.
- Lead security awareness training and the security side of personnel lifecycle processes.
- Support cyber insurance applications and renewals.
Business Continuity and Resilience- Own business continuity and disaster recovery planning, including regular testing and validation.
- Facilitate incident response tabletop exercises
Privacy and Data Governance- Own the data governance program and Rebuy's privacy documentation, including the privacy policy, DPA, subprocessor list, and vulnerability disclosure policy.
- Manage data subject requests and the automated processes that support them.
- Review new products, partnerships, and data-sharing arrangements for privacy and security impact.
- Review customer and vendor agreements for privacy and security terms in partnership with Legal.
- Help shape AI governance that supports Rebuy's open approach to AI tools while protecting company and customer data.
Security Operations and Incident Response- Own the incident response program, lead response to security incidents, and coordinate customer and regulatory notifications with Legal.
- Run vulnerability management across cloud, code, and endpoints, driving remediation with owning teams.
- Manage annual penetration testing from scoping through remediation.
- Partner with DevOps on CI/CD, deployments, and infrastructure so security is built in from the start.
Application and Cloud Security- Set application security standards and drive adoption across Engineering.
- Lead security initiatives such as authentication, logging, and monitoring alongside DevOps and Engineering.
- Define secrets management standards.
- Secure our cloud environment, including identity and access, network controls, and monitoring of sensitive data.
- Own email, domain, and DNS security.
IT Operations and Systems Administration- Manage the company's endpoint fleet, including device management, configuration baselines, patching, and hardware procurement and fulfillment for a remote workforce.
- Administer and secure the company's SaaS platforms.
- Provide IT support to employees.
Leadership and Budget Management- Report quarterly to executive leadership on security, risk, and compliance.
- Own tooling and budget decisions for a significant portion of the technology stack, including monitoring cloud spend.
- Serve as the company's trusted advisor on security and compliance.
The Hard Skills- 8+ years in security and GRC, including end-to-end ownership of a SOC 2 Type 2 program.
- Hands-on experience securing a major cloud environment (GCP preferred).
- Working knowledge of GDPR, CCPA/CPRA, and data governance practices.
- Experience with compliance automation, cloud security, and macOS device management tools (e.g., Vanta, Orca, Iru, or equivalents).
- Experience administering and securing a broad SaaS environment, including identity and access management.
- Experience building and testing BCP/DR plans and running incident response exercises.
- Application security fluency (e.g., OWASP Top 10, SAST, CI/CD, secrets management) sufficient to set standards and partner credibly with engineers.
- Ability to influence without authority and communicate risk to executives in business terms.
- Self-direction in a fast-moving, fully remote environment. You prioritize ruthlessly, document thoroughly, and automate where you can.
- Experience in the Shopify ecosystem.
- Workflow automation or scripting experience.
- Certifications such as CISSP, CISM, CCSP, or CIPP.
The Perks You'll EnjoyRebuy is a fully remote company across the U.S. and Canada that aims to provide all of our team with the resources, support and flexibility they need to thrive in their roles.
- Team: We've got the best, brightest, most brilliant team members who are excited to meet you! We also like to think we have a good sense of humor.
- Remote Work: With a strong internet connection, you're able to work from anywhere within the U.S. and Canada.
- PTO: We offer a flexible vacation policy, generous holiday schedule, parental leave and sick policy. There's other policies too like a birthday holiday!
- Amazing Benefits: 100% free health, dental, and insurance for you and your family. Don't worry, there's even more!
- Retirement Plans: For our U.S. employees we offer 401(k) retirement plans and for our Canadian employees we offer a TFSA and RRSP retirement plans. You'll also enjoy a 3% contribution of your gross salary, no matter where you're located!
Our compensation reflects the cost of labor across several U.S. geographic markets, and we pay differently based on those defined markets. The U.S. base pay range for this position is $175,000 - $200,000 USD annually. Pay within this range varies by work location and may also depend on job-related knowledge, skills, and experience. Your recruiter and hiring manager can share more about the specific salary range for the job location during the hiring process.
Disclosures:
