Director, Enterprise Security & IT

- Own security posture and incident readiness. Mature how Klue prevents, detects, and responds to security issues. Design the incident response process and governance, and make sure everyone knows their role before something goes wrong. - Run the compliance engine. Own the annual audit cycle against SOC 2 Type II, NIST CSF, and BSIMM, plus penetration testing, from evidence collection to a successful finish. Build audit methodology and documentation that make reviews faster and less painful for the whole company. - Be the security answer for go-to-market. Keep customer questionnaires, external assessments, and audits moving on time. Review and negotiate data protection agreements and security exhibits with customers and vendors so what we sign matches what we do. - Govern vendors, data, and privacy. Run full-spectrum vendor reviews, including sub-processor qualification. Own DLP, data retention, and the privacy framework for an international customer base, including data subject access requests. - Set the rules for AI and high-risk access. Own AI security governance: policies, risk acceptance, data handling, and permissioning for AI tools, agents, and integrations connected to company systems. Define and enforce access governance for high-risk systems, including admin access reviews, service accounts vs. individual credentials, and controls on sensitive logs and data. - Make security engineering's job easier. Set the security and compliance standard for Engineering's security work. Give the team the tooling, policy, and guidelines to build against, and translate their technical work into terms leadership and customers can act on. - Equip and enable every Kluebee. Own devices, access, and tooling across the full employee lifecycle. Manage the vendors behind our IT stack, set and hit reliability targets (SLOs) for corporate systems, and replace ad hoc fixes with repeatable processes that scale. Partner with People so onboarding and offboarding run smoothly. (Product infrastructure stays with Engineering.)

- You've run security and compliance at a company handling sensitive customer data. You're comfortable owning DLP, data retention, and privacy frameworks, and you can work through a security questionnaire or audit without panic. - You've led IT operations for a whole company, covering equipment, access, and tooling. - You know security frameworks (SOC 2, ISO 27001, NIST) and global privacy regulations (GDPR, CCPA) in depth. - You're comfortable with ambiguity and building without a playbook. - You communicate clearly with both technical peers and non-technical leaders, and can explain a risk to an engineer and to a CEO. - You've negotiated data protection agreements and security exhibits in vendor and customer contracts. - You understand AI security and governance: data retention commitments, access and permissioning for AI agents and integrations, and risk acceptance for AI tooling. - You've worked closely with product and engineering teams to turn security and compliance goals into reality.

AT KLUE https://klue.com/, WE’RE BUILDING THE FUTURE OF COMPETITIVE INTELLIGENCE WE’RE LOOKING FOR A SECURITY, COMPLIANCE & IT LEADER 👋 As our Director, Enterprise Security & IT, you'll sit at the intersection of security, compliance, and IT operations. You'll be accountable for how Klue protects customer data and how every Kluebee gets equipped to do their best work. Today, these three areas sit under different teams. You'll turn them into one team with one roadmap, working alongside an Engineering org that already builds and runs our product infrastructure. Your Mission? To own the security and compliance posture that our customers, our sales team, and our own people rely on. That covers everything we do: from building the product, to the internal automations, to the tools we use, and how we use AI. You'll set the standard, build the systems and set the rhythm to meet it. And in the process, make the secure way, the easy way. WHAT'S IN IT FOR YOU? You won't inherit a playbook. You'll write it. You'll define the operating model, the culture, and the technical direction for a brand-new function, and shape a small, sharp team of 2 from day one. You'll report directly to the CTO and work closely with the Senior Leadership Team, as well as the Engineering, Product, Sales, and People teams. You'll tackle big questions like how to govern AI agents connected to company systems, and your answers will set policy at Klue. As Klue grows, so do the team and your scope. You have the power to shape what that looks like. WHAT YOU'LL DO - Own security posture and incident readiness. Mature how Klue prevents, detects, and responds to security issues. Design the incident response process and governance, and make sure everyone knows their role before something goes wrong. - Run the compliance engine. Own the annual audit cycle against SOC 2 Type II, NIST CSF, and BSIMM, plus penetration testing, from evidence collection to a successful finish. Build audit methodology and documentation that make reviews faster and less painful for the whole company. - Be the security answer for go-to-market. Keep customer questionnaires, external assessments, and audits moving on time. Review and negotiate data protection agreements and security exhibits with customers and vendors so what we sign matches what we do. - Govern vendors, data, and privacy. Run full-spectrum vendor reviews, including sub-processor qualification. Own DLP, data retention, and the privacy framework for an international customer base, including data subject access requests. - Set the rules for AI and high-risk access. Own AI security governance: policies, risk acceptance, data handling, and permissioning for AI tools, agents, and integrations connected to company systems. Define and enforce access governance for high-risk systems, including admin access reviews, service accounts vs. individual credentials, and controls on sensitive logs and data. - Make security engineering's job easier. Set the security and compliance standard for Engineering's security work. Give the team the tooling, policy, and guidelines to build against, and translate their technical work into terms leadership and customers can act on. - Equip and enable every Kluebee. Own devices, access, and tooling across the full employee lifecycle. Manage the vendors behind our IT stack, set and hit reliability targets (SLOs) for corporate systems, and replace ad hoc fixes with repeatable processes that scale. Partner with People so onboarding and offboarding run smoothly. (Product infrastructure stays with Engineering.) WHAT SUCCESS LOOKS LIKE - One team, one roadmap. Within two quarters, Security, Compliance, and IT operate as one team with a shared roadmap and a regular operating rhythm. - Customers get fast, consistent answers. Questionnaires, audits, and sub-processor reviews are completed on time and in a repeatable way. - AI and access are governed, not improvised. High-risk systems and AI tools are covered by clear, documented policy, and admin access reviews are routine, not reactive. - Corporate systems are reliable. You define clear SLOs in your first quarter, and Klue meets or beats them. - We're ready when it counts. Incident response governance is documented and understood, and Engineering's security engineers have the tooling and guidelines to respond fast. - Day 1 just works. Every new Kluebee has working equipment and access on their first day, with no scrambling. - The budget is a set of clear choices. You actively manage the function's budget and make defensible tradeoffs between tooling, vendors, and headcount. - You're the default owner. The CTO and SLT turn to you for security, compliance, and IT. Engineering and GTM teams see you as the partner who makes their job easier, not another layer to work around. WHAT YOU BRING Must Haves - You've run security and compliance at a company handling sensitive customer data. You're comfortable owning DLP, data retention, and privacy frameworks, and you can work through a security questionnaire or audit without panic. - You've led IT operations for a whole company, covering equipment, access, and tooling. - You know security frameworks (SOC 2, ISO 27001, NIST) and global privacy regulations (GDPR, CCPA) in depth. - You're comfortable with ambiguity and building without a playbook. - You communicate clearly with both technical peers and non-technical leaders, and can explain a risk to an engineer and to a CEO. - You've negotiated data protection agreements and security exhibits in vendor and customer contracts. - You understand AI security and governance: data retention commitments, access and permissioning for AI agents and integrations, and risk acceptance for AI tooling. - You've worked closely with product and engineering teams to turn security and compliance goals into reality. Nice-to-Haves - You've owned a DevOps and/or security engineering fun