Head of security Job Phoenix area,Arizona USA,IT/Tech

Accountabilities:

Security Strategy and Leadership:
Define and own a risk-based security strategy and roadmap, prioritizing initiatives according to threat exposure, business impact, and operational risk. Communicate security posture, priorities, and investment needs to executive leadership and the board.
Incident Response and Resilience:
Lead the detection, investigation, containment, and recovery of security incidents. Maintain incident response playbooks, coordinate with external forensic specialists, legal counsel, and communications teams, and conduct post-incident reviews to drive continuous improvement.
Application Security:
Integrate security throughout the software development lifecycle through threat modeling, secure architecture reviews, code reviews, security testing, dependency scanning, and practical secure coding standards.
Cloud and Infrastructure Security:
Partner with infrastructure teams to strengthen security across AWS, Kubernetes, networking, and CI/CD pipelines. Oversee identity and access management, least-privilege controls, secrets management, and security practices for Terraform and Git Ops workflows.
Threat Detection and Monitoring:
Develop and improve security monitoring, logging, alerting, and detection capabilities across applications, infrastructure, and access systems. Optimize detection rules to identify malicious activity early while minimizing false positives.
Cryptographic and Key Management Security:
Define and maintain security controls for cryptographic keys, wallets, custody operations, and blockchain integrations supporting payment infrastructure.
Fraud and Account Protection:
Collaborate with Product and Risk teams to strengthen defenses against account takeover, fraudulent activity, abuse, and suspicious transactions.
AI Security and Governance:
Establish security guardrails for AI-assisted coding tools, AI agents, and LLM-powered systems. Address risks such as prompt injection, unauthorized tool access, excessive agent permissions, and sensitive data exposure.
Compliance and Security Assurance:
Lead the security compliance program, including SOC 2 and other relevant frameworks, audit preparation, customer assessments, and security questionnaires. Integrate compliance requirements into everyday engineering practices.
Third-Party and Vendor Risk:
Manage vendor security assessments and due diligence for strategic partners, investors, acquirers, and other external stakeholders.
Vulnerability and Patch Management:
Establish risk-based remediation timelines and severity-based SLAs, coordinating with engineering teams to address vulnerabilities efficiently without creating unnecessary delivery bottlenecks.
Team Building and Mentorship:
Recruit, develop, and lead security professionals while establishing a security champions network across product teams and raising security awareness throughout engineering.
Production Security Escalation:
Participate in and help define security escalation procedures for production incidents, ensuring effective coordination, timely decisions, and clear accountability.

Requirements:

At least 8 years of experience in information security or application security , including 3 or more years leading security teams or security functions .
Demonstrated experience managing high-impact security incidents, including coordinating investigations with external forensic specialists and legal counsel.
Strong hands-on knowledge of AWS and Kubernetes security, including IAM, network segmentation, role-based access control (RBAC), secrets management, container security, and image protection.
Proven experience implementing application security in microservices environments, including threat modeling, secure code reviews, dependency management, and…