Chief Information Security Officer, Cape

• 10+ years in information security, with at least 5 years in a senior security leadership role (CISO, VP Security, Head of Security) at a company with meaningful infrastructure or regulatory complexity
• Experience managing geographically dispersed teams of engineers
• A track record of building security teams and programs from an early stage, not just operating a mature one you inherited
• Deep technical credibility — you can go toe-to-toe with your best engineers on architecture and risk, while also speaking fluently to executive leadership and the board
• A genuine belief that privacy and security are inseparable, and that protecting users sometimes means resisting internal and external pressure to compromise on either
• Excellent judgment under ambiguity and the ability to move fast without cutting corners that matter

Desirable

• The CISO is our chief protector. Our infrastructure, threat model, and customer expectations are more complex than a typical mobile carrier or a typical software company. Your challenge is to enable rapid product innovation without compromising on our goal to be the most secure commercial mobile network on the planet
• You'll own the strategy and execution of security across our network, products, and corporate systems and work as a partner to Engineering and the executive team
• This is a build-and-defend role, not a maintain-the-status-quo role. You will immediately take ownership of a highly technical, responsive, and ambitious security, IT, and compliance org. Your mandate is to resource, mature, and scale this team to stay ahead of threats and enable Cape’s rapid growth
• This role is based out of our NYC or DC office and reports to our founder and CEO John Doyle
• Own Cape's end-to-end security strategy — network infrastructure, product/application security, cloud and corporate IT, and physical/personnel security
• Build and lead a security team capable of defending a carrier-grade network against sophisticated, well-resourced adversaries, including nation-state actors
• Design and drive the security architecture and controls for a cellular network we operate ourselves, from the radio access network through core infrastructure and subscriber data systems
• Partner closely with Engineering leadership to embed security into the product development lifecycle
• Lead teams conducting threat modeling, penetration testing, red-teaming, and incident response programs
• Set and communicate security policy to the board and executive team, translating technical risk into business terms and making tradeoffs with speed of execution
• Vet and manage relationships with external security vendors, auditors, and researchers, including running a responsible disclosure / bug bounty program
• Champion a security-first culture across the entire company, not just within the security team