• Define and own Shippo’s security strategy, translating business goals, customer trust needs, and regulatory requirements into a clear, prioritized security roadmap. • Plan and execute quarterly security initiatives that deliver meaningful risk reduction and enable business growth. • Continuously assess Shippo’s threat landscape and adjust priorities as the company, product surface area, and customer needs evolve. • Secure Shippo’s cloud and application environments, with deep ownership of AWS security architecture and controls. • Partner with Engineering teams to embed security into the SDLC, including application security reviews, SAST/DAST, dependency management, and secure design practices. • Own security operations, including incident readiness, response, and post-incident learning. • Lead security incidents end-to-end - from investigation and containment to postmortems and long-term remediation. • Conduct security risk assessments across applications, infrastructure, vendors, and processes; clearly communicate findings and recommendations to stakeholders. • Serve as the primary security point of contact for customer and partner security inquiries, audits, and escalations. • Lead, coach, and support a small security team, setting clear expectations, providing actionable feedback, and fostering a culture of learning and ownership.