Director, Security and Compliance

About the role

Rebuy is seeking a senior, hands‑on leader to own security, compliance, privacy, and IT across the company. Reporting to the COO, you will guide compliance programs, protect cloud infrastructure, manage data governance, and keep both people and systems secure.

Key responsibilities

• Lead SOC 2 Type 2, GDPR, CCPA/CPRA, and Shopify partner security compliance through audits and assessments.
• Own security policies, risk and vendor management, periodic access reviews, and incident response program.
• Develop business continuity, disaster recovery plans and run tabletop exercises.
• Manage data governance, privacy documentation, data‑subject requests, and AI governance.
• Set application and cloud security standards, drive authentication, logging, secrets management, and secure the GCP environment.
• Oversee endpoint fleet, SaaS platform security, and provide IT support for a remote workforce.

Required profile

• 8+ years in security and GRC with end‑to‑end SOC 2 ownership.
• Hands‑on experience securing a major cloud environment (preferably GCP).
• Strong knowledge of GDPR, CCPA/CPRA, and data‑governance practices.
• Ability to influence without formal authority and communicate risk to executives.

Required skills

• SOC 2 Type 2, GCP, GDPR, CCPA/CPRA.
• Compliance automation tools such as Vanta, Orca, Iru.
• Identity and access management for SaaS environments.
• Business continuity & disaster recovery planning.
• Incident response, vulnerability management, penetration testing.
• Application security standards (OWASP Top 10, SAST, CI/CD, secrets management).
• Relevant certifications (CISSP, CISM, CCSP, CIPP).

What we offer

• Fully remote work across the U.S. and Canada.
• Flexible PTO, parental leave, birthday holiday.
• 100% free health, dental, and vision insurance for employee and family.
• Retirement plans with 3% salary contribution.
• Base salary $175,000‑$200,000 USD annually.