Director of Security

1 мес. назад

USADirectorRemote

soc 2vantaincident responsesecurity auditcustomer security questionnairesvendor security reviews

Lead 's security program, including SOC 2 compliance, incident response, and customer security engagements.

Own Togal's SOC 2 Type II program end-to-end — evidence collection, audit management, and control ownership in Vanta — so it's audit-ready year-round, not just before an audit.
Turn around customer security questionnaires and vendor security reviews quickly and accurately.
Be Togal's front-line security contact for customers and prospects, including calls with customer-side CISOs and security teams during deal cycles and MSA negotiations.
Design a written incident-response and notification policy — clear triggers, timelines, escalation paths, and roles — that's actually followed, replacing today's ad hoc handling by the CTO and CEO.
Lead incident response when something does happen: containment, investigation, and coordinating any outside help needed (e.g., an MDR/IR retainer for surge capacity) — this is "own it when it happens," not the day-to-day center of the role.
Evaluate whether to buy, outsource, or build additional security monitoring — assess managed detection/SIEM options against what we actually need before committing engineering time to standing anything up ourselves.
Assess and tighten cloud security posture (IAM, configuration, logging) alongside the CTO and engineering team.
Partner with Legal and the CEO on breach determination and external communication, as a defined process rather than a one-off scramble.

Experience running a SOC 2 or similar compliance program end-to-end, including audit management and tooling (Vanta or equivalent).
Comfortable being the primary voice in customer-facing security conversations — you can sit across from a customer's CISO and hold your own.
Solid grounding in cloud security fundamentals (IAM, configuration management, logging) rather than just general cloud familiarity.
Enough hands-on technical depth to lead an incident when one occurs — you don't need to be a forensics specialist, but you should be credible investigating and coordinating a response.
Comfortable operating independently at an early-stage company, building the function as you go rather than stepping into an existing team or playbook.

Experience standing up a security/trust function from scratch at a startup or scale-up.
Background in construction tech or B2B SaaS.
Familiarity with email authentication and phishing/account-compromise forensics (DKIM/SPF/DMARC).
Experience evaluating or managing an MDR/IR retainer relationship.
You'd be Togal's first dedicated security hire, with the mandate to build the function the way you think it should work rather than inherit someone else's backlog. You'll be the person enterprise customers trust when security becomes a deal-maker or deal-breaker, work closely with the CTO and CEO, and have a direct hand in the deals where security is the deciding factor.
We are an equal opportunity employer committed to building a diverse team. We welcome applications from candidates of all backgrounds who are passionate about using technology to transform the construction industry.
Join us in revolutionizing pre-construction estimating with the power of AI!

We are an innovative technology company providing a cutting-edge, AI-powered cloud platform for the construction industry. Created by industry experts with deep estimating experience, our software dramatically streamlines the pre-construction process. Our solution uses advanced machine learning to automate traditionally time-consuming takeoff tasks, helping estimators work up to 80% faster while reducing costly errors.
Our collaborative platform enables real-time teamwork, instant drawing analysis, and features a revolutionary conversational AI interface that transforms how professionals interact with construction plans. Founded by construction industry veterans, our award-winning application automates the takeoff process, enabling estimators to analyze blueprints in seconds rather than hours or days.