• Own end-to-end information security strategy across cloud, application, infrastructure, and corporate environments. • Define a pragmatic security roadmap aligned to business risk, regulatory requirements, and engineering velocity. • Serve as the executive owner for security posture, risk management, and incident response. • Act as a trusted advisor to the CTO and executive team on security, risk, and operational tradeoffs. • Drive a DevSecOps-first operating model, embedding security into CI/CD pipelines, infrastructure as code, and developer workflows. • Partner deeply with engineering leadership to make security scalable, automated, and measurable. • Lead threat modeling, secure design reviews, and risk assessments for new platform initiatives. • Champion policy-as-code, guardrails, and automation over manual process. • Own security architecture and operations for a primarily AWS-based environment. • Lead application security programs, including secure SDLC, dependency scanning, SAST/DAST, penetration testing, and vulnerability management. • Build and run effective security operations, including monitoring, investigation, incident response, and post-incident learning. • Manage vendor relationships, including CrowdStrike, Flashpoint, RAD, and Okta. • Lead end-user computing, device management, endpoint security, identity lifecycle management, and access controls.