Security Manager

About This Role

This hands-on leadership role involves owning security across multiple brands, running the security program, leading incident response, and building a small security team as the company grows. The Security Manager sets the direction and performs technical work, reporting to the Head of Technology and briefing the leadership team monthly.

Responsibilities

• Own the security strategy and roadmap across all current and future brands
• Report on security posture and risk to leadership monthly
• Own incident response end to end and lead during live incidents
• Keep runbooks current, run tabletop exercises, and write postmortems
• Manage and develop the Security Engineer, and build the security team as the company scales
• Write and enforce security policies (access control, acceptable use, data handling, vendor review, incident response)
• Prepare the company for audits such as SOC 2, working with Legal & Compliance
• Own email security, staff training, and phishing simulations
• Run brand protection: find and take down fake domains and accounts impersonating brands on social media platforms
• Set security standards for customer accounts on platforms, including login protection and account-takeover defense
• Work with engineering teams to implement security standards on each platform
• Set rules for how AI agents and automations handle credentials, data, and tool permissions
• Review high-risk AI agents and automations before they go live
• Own the security stack (SIEM, endpoint protection, email security, identity and device management) and its vendors
• Set device and access standards for IT to run daily
• Supply security content for scam-awareness messaging to members, working with Community, Support, and Marketing, with Legal approval

Requirements

• 5+ years in security, including at least 2 years leading a security function or serving as senior security personnel at a company of 100+ people
• Has led live-incident response, not just tabletop exercises
• Has built or rebuilt a security program from an early stage: policy, tooling, training, and incident response
• Experience in crypto, fintech, or another high-fraud industry
• Deep, current knowledge of phishing, social engineering, and impersonation attacks and how to defend against them
• Hands-on experience with SIEM, endpoint protection, email security, and identity and device management platforms
• Can write scripts and automation rather than relying only on vendor UIs
• Writes clear security policy and gets people to follow it
• Briefs executives in plain language and trains non-technical staff