Head of Infrastructure & Security

We operate two connected businesses:
Rebus , a B2B SaaS platform serving enterprise warehouse and fulfillment operations, and Longbow Advantage , a WMS implementation and professional services firm.

Rebus ingests and stores sensitive operational and personally identifiable data on behalf of our customers, which makes us a data processor with real security and compliance obligations.

Longbow runs the corporate technology backbone that both businesses depend on, plus a small hosted-services footprint.

What to expect… We are looking for a Head of Infrastructure & Security ; a senior leader to own infrastructure, security, and IT across both businesses end to end.

Today these responsibilities sit with our VP of Product.

This role exists to take full ownership of that domain; not just to maintain it, but to mature it, secure it, and scale it as we grow past our current stage.

This is a hands-on leadership role, not a purely strategic one.

The Head of Infrastructure & Security will set direction and own outcomes, but at our scale you will also stay close enough to the technical detail to make sound architectural decisions and lead a small team of strong individual contributors This role is Work From Home & remote, located in Montreal with some in-person team meetings What You'll Own as Head of Infrastructure & Security :
SaaS Infrastructure (Rebus) End-to-end ownership of our cloud infrastructure on GCP, architecture, reliability, cost, scalability, and operational excellence The full cloud-native application environment; containerized and serverless workloads, cloud networking, and the large-scale, multi-tenant data layer (many terabytes of customer data on MongoDB Atlas), including the architecture, performance, and scaling decisions across all of it Deployment, release, and maintenance processes, with a focus on uptime and minimizing customer-facing disruption, recognizing that a platform outage during an active warehouse shift is a customer event, not just a ticket Leadership of our senior SRE, providing direction and architectural vision to move the platform forward Security & Compliance Our overall security program, policy, posture, tooling, and incident response, across both businesses Achieving and maintaining SOC 2 Type II (and evaluating ISO 27001 as the customer base demands), including driving the program, evidence, and audit relationships Customer-facing security: questionnaires, audits, and trust conversations with security-conscious enterprise buyers Data protection obligations as a data processor, including PII handling and relevant privacy regimes (e.g.

GDPR, CCPA) Managing security vendor relationships (MDR/EDR, SIEM, endpoint protection, penetration testing) Corporate IT & Hosted Services ( Longbow Advantage ) — oversight, not day-to-day This is the smaller part of the role; expect it to take no more than
-15% of your time.

We have a strong, capable IT team already in place, so what's needed here is direction, guidance, and oversight rather than hands-on operation.

Strategic direction and oversight of the internal IT function, corporate network, on-prem and cloud infrastructure, identity, endpoint management, help desk, and vendor relationships Light-touch oversight of a small, hosted WMS environment on GCP, including its reliability and availability commitments Mentorship and development of an established IT team, including an IT Manager and IT Administrators who handle the day-to-day What We're Looking For This role is weighed heavily toward SaaS infrastructure and security;

this is the core of the job.

A smaller component (15% of time) involves providing direction and oversight to an already-strong corporate IT team.

We are hiring first and foremost for depth in cloud infrastructure and security; the ability to give sound guidance to a capable IT function follows from that.

The reverse profile — a strong IT manager stepping up into SaaS security, is not what this role needs.

Required Significant experience owning production cloud infrastructure at scale, ideally on GCP, in a SaaS context Demonstrated ownership of a security program at a company handling sensitive customer data,…