SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Constructor is seeking a Director of Information Security to own the company's security program end-to-end. You will report to the CIO and serve as the senior security leader, responsible for protecting the platform, customer data, and the team.
Key responsibilities include:
- Customer trust & sales enablement: Answer prospect security questions, review security questionnaires, and represent Constructor's security posture to enterprise customers.
- Compliance & audit: Own SOC 2 Type II and ISO 27001 certification programs, manage external auditors, and maintain continuous compliance.
- Incident response: Own all security incidents from detection through resolution, maintain and improve the incident response plan.
- Risk management: Conduct risk assessments, maintain the risk register, and present risk posture to leadership and the board.
- Access governance: Run quarterly access reviews across all systems and enforce least-privilege principles.
- Internal advisory: Field questions from employees evaluating new tools, vendors, and workflows.
- AI governance: Define and maintain guardrails for internal AI use, balancing productivity with data protection.
- Security exercises: Plan and execute tabletop exercises, simulated incidents, and red/purple team engagements.
- DLP & insider threat: Oversee data loss prevention program, triage alerts, and refine policies.
- Vendor security: Review third-party vendor security posture and manage vendor risk assessments.
- Security awareness: Maintain employee security training program and foster a security-conscious culture.
- Infrastructure security partnership: Collaborate with Platform Engineering on cloud security posture (AWS), container security, and vulnerability management.
Required qualifications: 5+ years in information security with at least 2 years in a senior or leadership role. Deep familiarity with compliance frameworks (SOC 2, ISO 27001, GDPR, CCPA). Experience owning incident response end-to-end in SaaS or cloud-native environments. Comfortable in customer-facing settings. Hands-on experience with identity management (Okta or similar), MDM, DLP, and cloud security tooling. Strong understanding of application security in modern stacks. Excellent English written communication. Ability to operate independently in a fully remote culture. CISSP, CISM, or equivalent certification preferred.
Constructor is an AI-first search and product discovery platform for enterprise ecommerce, founded in 2015. The company works with major brands including Sephora, Petco, and Birkenstock.
