Director of Enterprise Security

Apptronik•Austin, TX

About The Position

Apptronik is seeking a Director of Enterprise Security to build and lead its enterprise information security program as the company scales its humanoid robotics business. Reporting to the Director of IT, this role owns enterprise risk management and governance frameworks and drives the company toward ISO 27001 certification. The focus is on protecting corporate systems, data, identities, and SaaS services. The successful candidate will establish an Information Security Management System (ISMS), translate framework requirements into practical policies and prioritized controls, and work closely with IT, legal, HR, finance, and operations. The position is a hands-on leadership role: initially, the director will design and implement controls directly while building and mentoring a security and GRC team over time. The role also operates the SOC 2 program alongside ISO 27001 and represents Apptronik in customer, partner, investor, and regulatory security engagements. This is a direct-hire role. The posting describes prolonged desk and computer work, periodic travel between Apptronik sites, customer locations, and industry events, and the vision, hearing, and speech needed to read and communicate.

Requirements

12 or more years of progressive information security experience, including 5 or more years leading enterprise security programs in a Director, Head of Security, or senior security leadership role.
Demonstrated fluency with ISO 27001, including the ISMS lifecycle, scoping, Statement of Applicability, risk assessment methodology, and end-to-end implementation of Annex A controls.
Track record of building enterprise security programs from the ground up at high-growth companies and driving them through ISO 27001 certification; SOC 2 Type I/II experience in parallel is also sought.
Strong expertise in risk management and governance, including risk registers, risk treatment, control frameworks, policy development, exception handling, internal audit, and executive-level risk reporting.
Working knowledge of relevant additional frameworks and regulations, including NIST CSF, NIST 800-53, CIS Controls, GDPR, CCPA, and export controls; ITAR/EAR knowledge is preferred.
Hands-on architectural depth with AWS, GCP, and/or Azure for corporate or enterprise workloads, including IAM, network security, encryption, and logging.
Strong identity and access management expertise, including Okta, SSO, MFA, conditional access, SCIM, lifecycle management, and privileged access controls.
Endpoint and corporate IT security experience across Linux, macOS, and Windows, including MDM tools such as Jamf or Intune, EDR, disk encryption, patching, and configuration management.
Experience operating detection and response capabilities, including SIEM, EDR, log pipelines, threat intelligence, and incident response, including leading real incidents end-to-end.
Ability to translate framework requirements into pragmatic, well-prioritized controls without unnecessarily slowing the business.
Excellent written and verbal communication skills, including executive and board briefings, clear policy writing, and engagement with external auditors and customers.
Strong leadership presence, sound judgment, composure under incident pressure, and ability to build trust across IT, legal, HR, finance, and operations.
Bachelor's degree in Computer Science, Information Security, Engineering, or a related field preferred; equivalent experience accepted.

Nice To Haves

Active senior security certifications such as CISSP, CISM, CCSP, CISA, ISO 27001 Lead Implementer or Lead Auditor, or GIAC; senior certifications are strongly preferred.
Master's degree, such as an MS in Information Security or an MBA with a security focus.
Experience leading enterprise security at a hardware, robotics, manufacturing, automotive, or aerospace company.
Experience with GRC platforms such as Vanta, Drata, OneTrust, or ServiceNow GRC to operationalize ISMS evidence and control monitoring.
Experience with additional frameworks such as NIST CSF audits, HITRUST, PCI-DSS, or TISAX.
Experience in environments subject to ITAR/EAR export controls or working with U.S. government or defense customers.
Prior experience scaling a security and GRC team from an individual contributor into a multi-discipline organization.

Responsibilities

Define and own the enterprise information security strategy, roadmap, and policies, and report on risk posture, program maturity, and initiatives to executives.
Design, implement, and operate an ISO 27001-aligned ISMS, including scoping, the Statement of Applicability, risk treatment plans, and Annex A controls, and drive the company toward ISO 27001 certification.
Own information security risk management, including the risk register, assessment methodology, risk acceptance and treatment processes, and recurring executive reporting.
Build and run security governance, including policies, standards, control ownership, exception handling, internal audit, control testing, and management reviews.
Operate the SOC 2 program alongside ISO 27001, map shared controls, own evidence collection, and manage external auditor and assessor relationships.
Establish enterprise security architecture for corporate cloud workloads, SaaS services, and corporate endpoints.
Build and operate vulnerability management, threat detection and response, and incident response capabilities for enterprise systems; select and operate EDR, SIEM, DLP, and email security tools, define playbooks, and lead tabletop exercises.
Own identity and access management governance with IT, including least privilege, SSO, MFA, conditional access, SCIM provisioning, privileged access management, and periodic access reviews.
Establish third-party security risk management and vendor security review processes, assessing SaaS, cloud, and supply-chain partners against contractual and regulatory security requirements.
Drive security awareness and training tailored to engineering, manufacturing, operations, and executive audiences.
Partner with the CIO in customer, partner, investor, and regulatory engagements, supporting security audits, due diligence, and enterprise security reviews.
Build, mentor, and grow a security and GRC team, initially serving as a working leader who designs and implements controls directly.