Senior Security, Compliance, and IT Leader

Rebuy is looking for a senior, hands-on leader to own security, compliance, privacy, and IT across the company. Reporting to the COO and briefing the executive team quarterly, you'll lead our compliance programs, protect our cloud infrastructure and applications, manage privacy and data governance, and keep our people and systems secure and productive.

This is an individual contributor leadership role. You'll set direction and drive security initiatives in partnership with our DevOps and Engineering teams. This is a great fit for someone who's comfortable as the accountable owner across many domains and can influence without formal authority.

What You’ll Do:

Governance, Risk and Compliance

• Lead Rebuy's compliance programs, including SOC 2 Type 2 (Security, Availability, Confidentiality), GDPR, CCPA/CPRA, and Shopify partner security requirements, through audits and third-party assessments.
• Own company security policies, risk management, and vendor risk management.
• Run periodic access reviews across company systems.
• Maintain our Trust Center and support Sales with customer security reviews and questionnaires.
• Lead security awareness training and the security side of personnel lifecycle processes.
• Support cyber insurance applications and renewals.

Business Continuity and Resilience

• Own business continuity and disaster recovery planning, including regular testing and validation.
• Facilitate incident response tabletop exercises.

Privacy and Data Governance

• Own the data governance program and Rebuy's privacy documentation, including the privacy policy, DPA, subprocessor list, and vulnerability disclosure policy.
• Manage data subject requests and the automated processes that support them.
• Review new products, partnerships, and data-sharing arrangements for privacy and security impact.
• Review customer and vendor agreements for privacy and security terms in partnership with Legal.
• Help shape AI governance that supports Rebuy's open approach to AI tools while protecting company and customer data.

Security Operations and Incident Response

• Own the incident response program, lead response to security incidents, and coordinate customer and regulatory notifications with Legal.
• Run vulnerability management across cloud, code, and endpoints, driving remediation with owning teams.
• Manage annual penetration testing from scoping through remediation.
• Partner with DevOps on CI/CD, deployments, and infrastructure so security is built in from the start.

Application and Cloud Security

• Set application security standards and drive adoption across Engineering.
• Lead security initiatives such as authentication, logging, and monitoring alongside DevOps and Engineering.
• Define secrets management standards.
• Secure our cloud environment, including identity and access, network controls, and monitoring of sensitive data.
• Own email, domain, and DNS security.

IT Operations and Systems Administration

• Manage the company's endpoint fleet, including device management, configuration baselines, patching, and hardware procurement and fulfillment for a remote workforce.
• Administer and secure the company's SaaS platforms.
• Provide IT support to employees.

Leadership and Budget Management

• Report quarterly to executive leadership on security, risk, and compliance.
• Own tooling and budget decisions for a significant portion of the technology stack, including monitoring cloud spend.
• Serve as the company's trusted advisor on security and compliance.

The Hard Skills:

• 8+ years in security and Governance, Risk, and Compliance (GRC), including end-to-end ownership of a SOC 2 Type 2 program.
• Hands-on experience securing a major cloud environment (GCP preferred).
• Working knowledge of GDPR, CCPA/CPRA, and data governance practices.
• Experience with compliance automation, cloud security, and macOS device management tools (e.g., Vanta, Orca, Iru, or equivalents).
• Experience administering and securing a broad SaaS environment, including identity and access management.
• Experience building and testing Business Continuity Plan (BCP) and Disaster Recovery (DR) plans and running incident response exercises.
• Application security fluency (e.g., OWASP Top 10, SAST, CI/CD, secrets management) sufficient to set standards and partner credibly with engineers.
• Ability to influence without authority and communicate risk to executives in business terms.
• Self-direction in a fast-moving, fully remote environment. You prioritize ruthlessly, document thoroughly, and automate where you can.
• Experience in the Shopify ecosystem.
• Workflow automation or scripting experience.
• Certifications such as CISSP, CISM, CCSP, or CIPP.