Director of Cyber Security

The posting, as RapidFort, Inc. wrote it

DIRECTOR OF CYBER SECURITY

Location: United States — Remote: West Coast preferred
Department: Information Technology — Security, Risk & Compliance

Eligibility: U.S. citizenship required

ABOUT RAPIDFORT

RapidFort is a cybersecurity company focused on helping organizations secure and optimize their software supply chain and containerized environments. Our platform helps teams reduce software vulnerabilities and attack surface while improving the security and efficiency of modern cloud-native applications.

We work with commercial enterprises and public-sector organizations operating in highly regulated and security-sensitive environments.

Title: Director of Cyber Security

Department: Information Technology — Security, Risk & Compliance

Reports To: Chief Information Officer, with a standing reporting line to the Audit Committee

Direct Reports: Security operations, security engineering, and governance/risk/compliance, including a dedicated compliance specialist

Location: REMOTE

Employment Type: Full-time

Travel: Periodic travel for audits, customer engagements, and leadership meetings

On-Call: Incident commander for declared security incidents

ABOUT THE ROLE

RapidFort Inc. is looking for a Director of Cyber Security to own our security posture and the risk position behind it — what our controls are, whether they work, what remains exposed, and who has accepted that exposure.

This is a horizontal role by design. Cloud Operations, Infrastructure Engineering, and Corporate IT each own an estate and run it. You own the standard those estates are held to, the evidence that the standard is met, and the response when it is not.

You set the requirement and verify the outcome; the estate owner executes the remediation. That separation is deliberate — it is what makes the assurance worth anything.

You will own the ISO 27001 ISMS and the SOC 2 Type 2 program end to end, command security incidents with authority to direct containment across any estate, and give executive leadership and the Audit Committee an honest, current view of where our risk actually sits.

You will also own two program we need closed: FedRAMP authorization and CMMC Level 2. Both are live commitments rather than aspirations, and between them they will reshape how we scope, evidence, and monitor controls. You will have a dedicated compliance specialist to run the evidence machinery across all four frameworks — your job is to sequence them against one control set rather than four, and to carry the scoping and risk decisions that a specialist cannot.

Security is also part of our commercial proposition. You will be the person customers’ security teams talk to — questionnaires, customer audits, and the security terms in our contracts — and the person who decides what we will not agree to.

This role reports to the CIO but carries a standing reporting line to the Audit Committee, including the explicit right to escalate unresolved material risk without CIO clearance. We wou
[…]

• Build continuous control monitoring so compliance is a measured state, not an annual scramble.
• Direct the compliance specialist, who runs evidence collection, control testing, POA&M tracking, and audit logistics. You keep framework scope, control interpretation, assessor and sponsor relationships, and the risk decisions behind them.
• Own customer security assurance — questionnaires, customer audits, trust documentation, and security terms in contracts and DPAs.
• Own the customer assurance pipeline: questionnaire intake, a library of pre-approved answers, and a turnaround commitment to Sales. The specialist drafts; you approve anything that commits us to a control, a date, or a contractual term.
• Own controlled distribution of audit artifacts under NDA — SOC 2 report, penetration test summaries, certifications, authorization packages — and decide what is not released.

Third-party risk and security culture

• Own vendor and SaaS security assessment: tier, assessment depth, sign-off before contract, and reassessment cadence.
• Own security requirements in vendor contracts — control obligations, right to audit, and incident notification terms.
• Own the awareness program, phishing simulation, and role-specific training for developers, privileged operators, and executives.

COMPENSATION & BENEFITS

RapidFort offers a competitive total rewards package that includes

• Base Salary: $200,000–$245,000 USD annually, depending on experience, qualifications, and location
• Annual performance-based bonus
• Equity: Stock options in RapidFort
• Medical, dental, and vision insurance
• 401(k) retirement plan
• Paid time off and company holidays
• Paid sick leave
• Company-provided equipment
• Professional development and growth opportunities

RapidFort is an equal opportunity employer. We consider qualified applicants without regard to race, color, religion, sex, national origin, age, disability, veteran status, or any other characteristic protected by applicable law.