Director, Information Security

Etsy•Brooklyn, NY

1d•$252,000 - $378,000•Hybrid

About The Position

Etsy is hiring a Director of Security to protect its marketplace, products, data, and enterprise technology. The Director will set security strategy, guide investment decisions, and help teams build and operate secure services. The role oversees application and product security; cloud and infrastructure security; identity, endpoint, and corporate platform security; security operations and incident response; and security governance, risk, and compliance. This full-time position reports to the VP of Engineering, CISO. Etsy’s security teams build tools, operate defenses, advise colleagues, and respond to incidents. They work with engineering and business teams to identify risks and make secure decisions easier. The team tests and measures its work, uses continuous deployment, and learns from incidents through a blameless approach. Leaders support clear ownership, shared learning, and career development. The Director will set the security strategy and roadmap; manage organizational design, staffing, budgets, tools, and service providers; develop security staff and managers; guide vulnerability management, detection, threat intelligence, and incident response; and integrate security into product development and enterprise technology. The role also oversees security policies, risk assessments, audit readiness, supplier security, employee security education, and evaluation of emerging threats and technologies, including AI-enabled systems and security automation. The Director reports security metrics and communicates risks and investment decisions to executives and business partners. Duties may include other tasks and may change from time to time at Etsy’s discretion or as applicable local law permits. Candidates are prioritized within commuting distance of Etsy’s Brooklyn office. Depending on proximity, team members are asked to work in the office once or twice per week. Remote candidates outside commuting distance may be considered case by case, with occasional office travel expected. Base salary varies by location, skills, and experience. The annual range is $280,000–$378,000 for Geo-1 (New York City metropolitan area, San Francisco Bay Area, and Seattle metropolitan area) and $252,000–$340,000 for Geo-2 (all other U.S. locations). In addition to salary, the role is eligible for an equity package, an annual performance bonus, and competitive benefits supporting employees and their families.

Requirements

10+ years of experience in information security, including 6+ years in security leadership roles.
Experienced security leader combining technical depth, operational judgment, and organizational leadership; able to set direction, engage in technical decisions, and help teams execute through ambiguity.
Track record of running or scaling a sizeable security organization with software engineering, security operations, architecture, or risk and compliance capabilities.
Strong technical foundation in software engineering, cloud security, infrastructure, application security, identity and access management, or security architecture.
Experience evaluating or securing AI-enabled systems, agentic workflows, or automated security operations.
Experience leading security operations and significant incident response efforts, including preparedness, exercises, executive communications, remediation, and lessons learned.
Ability to define meaningful security metrics and communicate technical risk, tradeoffs, and investment recommendations to executive and nontechnical stakeholders.
Excellent written and verbal communication skills, sound judgment under pressure, and ability to influence outcomes without relying on hierarchy.
Collaborative, pragmatic, and customer-minded approach while maintaining a high bar for security outcomes.
Leadership style that develops people, creates clarity, empowers teams, and holds leaders accountable for results.

Nice To Haves

Experience securing a large-scale consumer marketplace, online service, or similarly complex technology environment.
Experience with GCP and modern cloud-native security architectures.

Responsibilities

Set the security strategy and roadmap.
Manage organizational design, staffing, budgets, tools, and service providers, prioritizing according to business needs and security risk.
Develop security engineers, analysts, architects, and managers; establish clear responsibilities and support professional growth.
Guide vulnerability management, detection, threat intelligence, and incident response.
Maintain tested incident response plans, coordinate communications, and partner on business continuity and recovery exercises.
Integrate security into product development and enterprise technology, including architecture reviews, threat modeling, security testing, and controls for cloud services, identity, endpoints, and corporate systems.
Oversee security policies, risk assessments, audit readiness, and supplier security.
Report metrics on security coverage, remediation progress, and incident trends; explain risks and investment decisions to executives and business partners.
Guide employee security education.
Assess emerging threats and technologies, including AI-enabled systems and security automation.
Perform other duties as required; job duties and responsibilities may change from time to time.