Information Security Executive

The ideal candidate is a self-starter, problem-solver, and successful in combining technology and data into best-in-class outcomes. The candidate is energized by solving complex business problems and consistently effective in making high-judgment decisions at a rapid pace amidst the frequent ambiguity that comes with charting a course of action with no precedent. Moreover, the ideal candidate is energized by an environment where strategy, innovation, and decision-making are intentionally distributed; where candor, speed, and data are highly valued; and where colleagues at all levels hold each other to unusually high standards on behalf of our customers.
Responsibilities:
Develops and manages Quince's overall approach to data security and information protection.
Align standards, frameworks, and security with the overall business and technology strategy.
Design security architecture elements to mitigate threats as they emerge.
Audits the collection, use, and retention of all personal data within Quince.
Ensures all Quince policies around data protection and information security are up to date and fit for purpose.
Defines, implements, and maintains corporate security policies.
Leads on the identification of data security and information protection risks across the organization and works with stakeholders to develop and implement mitigation plans, escalating issues as appropriate.
Acts as a subject matter expert on data security for projects looking to implement new tools, products, or processes.
Supports the Global IT Operations Manager to achieve the highest standards of information security across Quince's network.
Oversees maintenance of systems to protect data from unauthorized users.
Develops and maintains process maps, which show how data flows through the organization.
Leads and facilitates organizational training and communications around data security and information protection issues.
Oversee incident response planning as well as the investigation of security breaches and assist with disciplinary and legal matters associated with such breaches as necessary.
Implements measures to protect digital files and information systems against unauthorized access, modification, or destruction.
Requirements:
Experience in building cloud security infrastructure on AWS, GCP, or other public clouds.
Experience with Conducting Web/API and Infrastructure Security Assessments.
Know about conducting a security architecture review and threat modeling.
Familiar with the integration of scanning tool automation into the CI pipeline.
Strong knowledge of securing code review and developer security education.
Knowledge of Securing Federated Architectures, SAML2.0 Remediation of OWASP Top 10 classes, CWE-25 XSS, XSRF, Command Injection, etc.
Experience conducting penetration testing.
Know about Jenkins Pipeline Automation.
Good experience with any scripting language; Python preferred.
Sensitive Data Review: Securing data at rest and in transit.
Familiar with security incident response and management and customer engagement.
Experience building Key Management Infrastructure.
Experience with Linux OS hardening, OSCAP tools, and Red Hat STIG/DISA STIG.
Degree in Information Technology, Computer Science, Software Engineering, or a related field.
Knowledge of information technology security issues and approaches to managing them.
Information technology security.
Knowledge of data protection operations and legislation (GDPR), CCPA.
At least one recognized security certification:
Certified Ethical Hacker (CEH).
CompTIA Security+.
Certified Information System Security Professional (CISSP).
Certified Information Security Manager (CISM).
Certified Information Systems Auditor (CISA).

Experience
2-6 yrs