Head of Privacy and Information Security

Key Responsibilites:

• RFP/RFI Management - Oversee the end-to-end process of responding to security-related RFPs, RFIs, and questionnaires. This includes analyzing requirements, collaborating with internal teams to create thorough responses, and ensuring timely, accurate submissions. Maintain detailed records and facilitate clear communication with clients, vendors, and internal stakeholders.
• Privacy and Security Strategy & Oversight: Develop and implement an organization-wide privacy and information security strategy that aligns with regulatory requirements and best practices. As the Company’s Head of Privacy, serve as the primary point of contact for data privacy matters, ensuring compliance with privacy laws, overseeing data protection practices, and advising on privacy implications across all company operations and new initiatives.
• Compliance and Data Protection Standards: Ensure compliance with industry regulations (e.g., GDPR, SOC2, ISO 27001) by establishing and maintaining robust data protection policies and information security standards. Assist with audits and evidence gathering related to SOC2 compliance and other privacy frameworks, providing oversight for security controls and data protection measures.
• Data Governance and Risk Management: Conduct and document security and data privacy risk assessments, compliance reviews, and communicate risk mitigation strategies to senior leadership, engineering, and relevant stakeholders.
• Security Infrastructure and Vulnerability Management: Monitor both on-prem and cloud infrastructure for vulnerabilities, assess risk factors, and implement solutions to improve security and data protection.
• Privacy by Design: Partner with product and engineering teams to embed privacy and data protection principles in the product lifecycle, from initial design to deployment.
• Security and Privacy Awareness: Lead employee security and privacy training initiatives focused on email threats, data handling, and best practices in protecting sensitive information.
• Incident Response and Recovery: Manage incident response for security and data privacy breaches, conduct root cause analyses, and oversee remediation efforts.
• Third-Party Vendor Management: Coordinate with third parties on security and privacy audits, assessments, and remediation efforts (e.g., penetration testing, bug bounty programs).
• Policy Development and Access Management: Oversee development of information security and privacy policies, conduct regular access management reviews, and implement technical controls for data protection.
• Privacy Impact Assessments (PIAs): Conduct and review PIAs to evaluate privacy risks associated with new projects, technologies, and data processing activities.
• Security Metrics and Reporting: Gather, document, and report security and privacy metrics, analyzing trends to guide continuous improvement.

Qualifications:

• Experience: 7+ years in information security, data protection, and privacy roles.
• Technical Skills: Proficiency in cloud technologies (e.g., AWS) and experience securing hybrid environments (on-premises and cloud).
• Security Solutions: Hands-on experience managing security solutions such as SIEM, EDR, firewalls, IPS/IDS, and encryption.
• Privacy Frameworks: In-depth knowledge of data protection regulations and standards (GDPR, SOC2, ISO 27001, NIST 800-171).
• Certifications: Industry-recognized certifications (CISSP, CIPP, CISA, Certified Ethical Hacker, CompTIA Security+) are preferred.
• Incident Management: Proven experience in incident response, management, and root cause analysis.
• Analytical Skills: Ability to conduct privacy and security risk assessments and analyze network traffic, system alerts, and data logs for trends.
• Communication and Collaboration: Excellent ability to convey complex privacy and security concepts to technical and non-technical audiences.
• Autonomy and Organization: Ability to work independently, prioritize tasks effectively, and manage multiple projects concurrently.