Director of Cybersecurity (Remote)

About the role

A growing SaaS company that builds software for utility damage prevention and infrastructure risk management is looking for a Director of Cybersecurity. The role owns and matures the security program across SaaS products and corporate IT, combining hands-on technical work (vulnerability triage, incident response) with setting standards and policy and working with engineering, infrastructure, IT, GRC and executives. It is remote, open to the United States and Canada, and is a newly created position.

Key responsibilities

• Triage and prioritize security findings from SAST tools, infrastructure assessments, penetration tests and new CVEs, assess risk, set priorities and assign owners and deadlines
• Work with engineering and infrastructure teams to fix vulnerabilities through patching, configuration changes, dependency upgrades and decommissioning, and track progress to leadership
• Lead incident response from detection through containment and remediation, manage communications and runbooks, and run tabletop exercises
• Own cloud security posture on AWS and Microsoft Azure, and identity and access management policies, MFA, privileged access and access reviews
• Develop security policies aligned with NIST CSF and ISO 27001, own technical controls for SOC 2 Type II and ISO 27001, and partner with GRC on audits
• Translate regulatory requirements for critical infrastructure customers (e.g., TSA pipeline directives, NERC CIP, Canadian privacy law) into technical controls and lead technical responses to customer security questionnaires

Required profile

• 8+ years in cybersecurity engineering or security operations, including at least 3 years leading a security program, preferably in a SaaS organization
• Proven end-to-end ownership of vulnerability management and proven leadership of incident response
• Working knowledge of SOC 2 Type II, ISO 27001 and NIST CSF, including as a key technical control owner through at least one SOC 2 Type II audit
• Ability to read application code, IaC and Linux/Windows server configurations; strong communication skills

Required skills

• Hands-on cloud security on AWS and Microsoft Azure, including IAM, CloudTrail and Entra audit logs
• Cloud security posture management tools such as Wiz
• Nice to have: Microsoft 365 security, SentinelOne, Canadian privacy requirements (Quebec Law 25), cybersecurity due diligence, and people management experience

What we offer

• Competitive salary and comprehensive health, dental and vision coverage
• 401(k) with company match, flexible PTO and company-paid holidays
• Life insurance, pet insurance, employee discounts and perks, and a one-time work-from-home stipend