Security Manager, SpotHero

• 5+ years in security operations or application security, 2+ years of people or initiative leadership experience
• Strong technical background with hands-on ability: scripting, tool setup, ethical hacking, automation
• Deep knowledge of cybersecurity as it applies to modern cloud-native applications and corporate SaaS ecosystems
• Great communication skills and the ability to influence without authority across teams
• Passion for mentoring, documentation, and practical risk management

Desirable

• SpotHero is looking for a hands-on Security Manager to lead and evolve our security program across both our consumer-facing applications and internal IT infrastructure
• This is a player/coach role: you’ll be directly responsible for technical implementation while also driving strategy, leading initiatives, and mentoring a small team
• We’re seeking someone with deep security expertise who thrives in fast-moving environments and can bridge engineering, IT, and compliance
• Build and lead SpotHero’s security program across application, infrastructure (AWS, Kubernetes, Docker), and corporate environments
• Champion DevSecOps and SecOps practices across engineering and IT
• Design and deliver internal security education, including training on OWASP Top 10 and phishing awareness
• Own application testing initiatives including annual penetration tests, regular vulnerability scanning, and remediation tracking
• Maintain and evolve our risk register and governance documentation
• Manage and respond to security reports from our bug bounty program
• Partner with Corporate IT to secure endpoints, SaaS tools (Google Workspace, Atlassian, etc.), and internal networks
• Drive SOC 2 and broader GRC efforts, leading documentation, process alignment, and audits
• Oversee third-party risk management and security reviews for vendors and partner questionnaires
• Conduct forensics and root cause analysis of security incidents
• Ensure operational excellence across identity and access management platforms and core security tooling
• Manage external vendors and security consulting engagements