Manager, Corporate Technology – Security & IT

Responsibilities

• You will own Caribou’s security and IT programs.
• Your team includes three senior security practitioners and a senior IT administrator.
• You set the direction, hold the strategy and vendor relationships, and keep the programs advancing.
• Caribou's security posture advances year over year - the program has a roadmap, diligence reviews go smoothly, and findings reflect it.
• SOC 2 Type II delivers clean with no surprises - systematic evidence collection, not a heroics sprint at audit time.
• Detection and response capabilities improve measurably - SIEM, Crowd Strike, Wiz, and DLP are operationally sound and the team can say why.
• GRC policy and control documents reflect how Caribou actually operates, not how it operated two years ago.
• Licensed tools earn their keep - Google Workspace, Slack, Atlassian, Asana, 1
  
  Password, and Adobe are actively used, not just provisioned.
• An operational AI enablement program that drives measurable adoption of licensed AI capabilities and a growing backlog of automated workflows.
• IT operations run without drama - the MSP delivers, support is responsive, and productivity loss from tech issues stays low.
• Every direct report has a growth plan, gets regular coaching, and is taking on more complex work than when you arrived.
• The vendor portfolio - security and IT - delivers expected value and you can demonstrate it.

• You've delivered a SOC 2 Type II audit as the primary owner - the audit was yours to pass.
• You've managed a detection and response function: SIEM tuning, EDR deployment, incident ownership.
• You've built or maintained GRC policy and control documentation that held up under audit scrutiny.
• You've worked in a regulated environment and understand how compliance obligations translate into operational controls.
• You've managed security vendor relationships - EDR, CSPM, penetration testing firms - and can tell when a vendor isn't delivering.
• You've run a SaaS portfolio for a growing company - licensing, governance, adoption, and the shadow IT problem.
• You've led an enterprise-wide software rollout end-to-end: implementation, adoption, and proof that features are delivering value.
• You’ve researched, planned, or executed a rollout of enterprise AI tools and have ideas of how to do it better.
• You've run identity and access management end-to‑end - not just the policy, but the provisioning workflow and the audit evidence.
• You've managed an MSP relationship and held them accountable to a service standard.