SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 175,000 - 200,000 / annual
Rebuy is a fully remote, venture-backed commerce platform that powers personalized shopping experiences for fast-growing DTC brands including Tecovas, Momofuku, Dime Beauty, Liquid Death, Magic Spoon, and OLLY.
You will own security, compliance, privacy, and IT across the company as a senior, hands-on leader reporting to the COO with quarterly briefings to the executive team. This is an individual contributor leadership role where you'll set direction and drive security initiatives in partnership with DevOps and Engineering teams, influencing without formal authority across multiple domains.
Key Responsibilities:
Governance, Risk & Compliance: Lead SOC 2 Type 2, GDPR, CCPA/CPRA, and Shopify partner security compliance programs through audits and assessments. Own company security policies, risk management, and vendor risk management. Run periodic access reviews, maintain the Trust Center, support customer security reviews, lead security awareness training, and manage cyber insurance applications.
Business Continuity & Resilience: Own business continuity and disaster recovery planning with regular testing and validation. Facilitate incident response tabletop exercises.
Privacy & Data Governance: Own the data governance program and privacy documentation (privacy policy, DPA, subprocessor list, vulnerability disclosure policy). Manage data subject requests and review new products, partnerships, and data-sharing arrangements for privacy/security impact. Help shape AI governance.
Security Operations & Incident Response: Own the incident response program, lead response to security incidents, and coordinate notifications. Run vulnerability management across cloud, code, and endpoints. Manage annual penetration testing. Partner with DevOps on CI/CD and infrastructure security.
Application & Cloud Security: Set application security standards and drive adoption. Lead security initiatives (authentication, logging, monitoring). Define secrets management standards. Secure cloud environment including identity, access, network controls, and sensitive data monitoring. Own email, domain, and DNS security.
IT Operations: Manage endpoint fleet for remote workforce (device management, patching, hardware procurement). Administer and secure SaaS platforms. Provide IT support to employees.
Leadership & Budget: Report quarterly to executives on security, risk, and compliance. Own tooling and budget decisions for significant portions of the tech stack. Serve as trusted advisor on security and compliance.
Requirements:
- 8+ years in security and GRC, including end-to-end ownership of a SOC 2 Type 2 program
- Hands-on experience securing a major cloud environment (GCP preferred)
- Working knowledge of GDPR, CCPA/CPRA, and data governance practices
- Experience with compliance automation, cloud security, and macOS device management tools (Vanta, Orca, Iru, or equivalents)
- Experience administering and securing a broad SaaS environment, including identity and access management
- Experience building and testing BCP/DR plans and running incident response exercises
- Application security fluency (OWASP Top 10, SAST, CI/CD, secrets management) sufficient to set standards and partner with engineers
- Ability to influence without authority and communicate risk to executives in business terms
- Self-direction in fast-moving, fully remote environment with ruthless prioritization, thorough documentation, and automation
- Experience in Shopify ecosystem (preferred)
- Workflow automation or scripting experience (preferred)
- Certifications such as CISSP, CISM, CCSP, or CIPP (preferred)
