Responsibilities

The Lead Security Engineer & DPO will own the security posture of the company across software, hardware, infrastructure, and third-party services, partner with engineering teams to review designs and ensure secure implementation practices, lead threat modeling and secure development lifecycle (SDLC) processes, build and maintain internal tooling and automation, coordinate penetration testing and manage the response to the results, serve as the escalation point for security incidents and coordinate response efforts, maintain and improve logging, monitoring, and alerting systems, conduct root cause analyses and lead post-mortem reviews for security events, lead SOC 2 Type II and GDPR compliance initiatives, manage third-party risk assessments and vendor security reviews, define, maintain, and socialize internal security and privacy policies, oversee employee security awareness training and audits, monitor compliance with GDPR and other data protection laws, advise internal teams on privacy impact assessments (DPIAs), data retention, and lawful bases for processing, serve as the primary point of contact for data subject requests (DSARs) and supervisory authorities, ensure privacy-by-design is embedded into engineering and product development, leading the process of responding to security questionnaire from vendors and companies who use us as a data processor, act as a security and privacy design partner across product, hardware, legal, and engineering, and communicate security risks and mitigations to leadership and business teams.