Head of Information Security

We operate on a hybrid schedule where employees are generally expected to work from the office four days a week, with one flexible remote day per week.

We're looking for someone who understands how to secure modern web applications and cloud infrastructure, can identify and prioritize meaningful risks, and is comfortable working directly with technical teams to implement improvements.

We're more interested in practical experience, sound judgment, technical competence, and the ability to make measurable security improvements than previous job titles or organizational responsibilities.

• 5+ years of progressive experience in information security, application security, security engineering, or related fields.
• Experience implementing or improving security practices in a SaaS, ecommerce, fintech, or comparable technology environment.
• Strong working knowledge of web application, API, and cloud infrastructure security (AWS preferred).
• Practical understanding of:
• • Secure software development lifecycle (SDLC) practices
  • Vulnerability identification, management, and remediation
  • Identity and access management (IAM)
  • Encryption and data protection fundamentals
• Working knowledge of PCI-DSS requirements and payment security practices.
• Experience collaborating with technical teams to identify and address security vulnerabilities.
• Ability to communicate security risks and recommendations to both technical and nontechnical stakeholders.

• Experience in high-transaction environments with elevated fraud or security risks, such as fintech, ticketing, ecommerce, or payments.
• Experience working with globally distributed engineering teams.
• Experience supporting PCI-DSS assessments, SOC 2 readiness, or comparable compliance initiatives.
• Familiarity with data privacy regulations and frameworks, including GDPR and the Data Privacy Framework.
• Experience developing incident response procedures, conducting security assessments, or managing security-related projects.
• Security certifications such as CISSP, CISM, CCSP, or comparable credentials.
• Previous experience leading security initiatives, mentoring technical staff, or coordinating cross-functional security efforts.

• Assess existing security practices and identify opportunities to strengthen Etix's overall security posture.
• Develop and maintain a prioritized security improvement plan aligned with business needs and available resources.
• Establish practical security policies, procedures, and controls in collaboration with internal stakeholders.
• Define and track key security metrics, providing regular updates on risks, progress, and recommended improvements.
• Evaluate security tools and technologies that can improve threat detection, vulnerability management, and operational efficiency.

• Work closely with Engineering and IT to identify and address security risks within Etix's applications, APIs, and infrastructure.
• Support the adoption and improvement of secure software development practices, including code security reviews, vulnerability scanning, and remediation processes.
• Collaborate with technical teams to strengthen cloud security, network controls, identity and access management, and monitoring practices.
• Participate in architectural and technical reviews to identify potential security risks and recommend appropriate safeguards.
• Help establish repeatable, automated security processes that reduce manual effort and operational risk.
• Coordinate security improvements across U.S. and international development teams.

• Partner with Legal, Product, Engineering, and IT to establish and improve data protection practices, including data classification, access controls, encryption, and retention.
• Support compliance with applicable privacy and data protection requirements by identifying and implementing appropriate technical security controls.
• Coordinate PCI-DSS security activities, including readiness assessments, documentation, remediation efforts, and collaboration with external assessors.
• Support customer and partner security assessments, questionnaires, and compliance-related requests.
• Assist in evaluating readiness for additional security frameworks, such as SOC 2, as business needs evolve.

• Develop, document, and coordinate practical security incident response procedures in collaboration with Engineering, IT, and executive leadership.
• Help establish processes for identifying, reporting, investigating, and resolving security incidents.
• Maintain a security risk register and work with internal teams to prioritize remediation based on business impact.
• Coordinate periodic security assessments, vulnerability reviews, and follow-up remediation activities.
• Serve as a primary point of contact for internal security questions, customer security reviews, and third-party assessments.
• Recommend improvements based on security incidents, assessments, and emerging risks.
  
  

• No sponsorship or H1B situations can be accommodated
• Relocation is not available for this position