Director of Enterprise Security

Apptronik•Austin, TX

22h

About The Position

Apptronik is seeking a Director of Enterprise Security to build and lead its enterprise information security program as the company scales its humanoid robotics business. The role owns enterprise risk management and governance frameworks and drives the company toward ISO 27001 certification. It focuses on protecting corporate systems, data, identities, and SaaS services. The successful candidate will translate framework requirements into clear policies and prioritized controls, establish an Information Security Management System (ISMS), and partner with leaders across IT, legal, HR, finance, and operations. The role reports to the Director of IT; the job summary also describes partnering with the CIO in external engagements. The director will define enterprise security strategy, operate ISO 27001 and SOC 2 programs, establish security architecture for corporate cloud, SaaS, and endpoints, and build vulnerability management, detection, response, identity governance, and third-party risk capabilities. The position also leads awareness and training, supports customer and other external security reviews, and grows a security and GRC team over time. Initially, this is a hands-on working-leader role that designs and implements controls directly.

Requirements

12+ years of progressive information security experience, including 5+ years leading enterprise security programs as a Director, Head of Security, or in a senior security leadership role.
Deep demonstrated fluency with ISO 27001, including the ISMS lifecycle, scoping, Statement of Applicability, risk assessment methodology, and end-to-end implementation of Annex A controls.
Track record of building enterprise security programs from the ground up at high-growth companies and driving them through ISO 27001 certification; SOC 2 Type I/II experience in parallel is described as ideal.
Strong expertise in risk management and governance, including risk registers, risk treatment, control frameworks, policy development, exception handling, internal audit, and executive-level risk reporting.
Working knowledge of relevant frameworks and regulations such as NIST CSF, NIST 800-53, CIS Controls, GDPR, CCPA, and export controls; ITAR/EAR experience is preferred in the requirements section.
Hands-on architectural depth across AWS, GCP, and/or Azure for corporate or enterprise workloads, including IAM, network security, encryption, and logging.
Strong identity and access management expertise, including Okta, SSO, MFA, conditional access, SCIM, lifecycle management, and privileged access controls.
Endpoint and corporate IT security experience across Linux, macOS, and Windows, including MDM such as Jamf or Intune, EDR, disk encryption, patching, and configuration management.
Experience operating detection and response capabilities, including SIEM, EDR, log pipelines, threat intelligence, and incident response, including leading real incidents end-to-end.
Ability to translate framework requirements into pragmatic, well-prioritized controls without unnecessarily slowing the business.
Excellent written and verbal communication skills, including executive and board briefings, policy writing, and engagement with external auditors and customers.
Strong leadership presence, sound judgment, calm under incident pressure, and ability to build trust across IT, legal, HR, finance, and operations.
12+ years of information security experience with substantial time in security leadership roles.
Bachelor's degree in Computer Science, Information Security, Engineering, or a related field preferred; equivalent experience accepted.

Nice To Haves

Certifications such as CISSP, CISM, CISA, CCSP, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor.
Experience leading enterprise security at a hardware, robotics, manufacturing, automotive, or aerospace company.
Experience with GRC platforms such as Vanta, Drata, OneTrust, or ServiceNow GRC to operationalize ISMS evidence and control monitoring.
Experience with additional frameworks such as NIST CSF audits, HITRUST, PCI-DSS, or TISAX.
Experience in environments subject to ITAR/EAR export controls or working with U.S. government or defense customers.
Prior experience scaling a security and GRC team from an individual contributor into a multi-discipline organization.
Master's degree, such as an MS in Information Security or an MBA with a security focus.
Active senior security certifications such as CISSP, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or GIAC.

Responsibilities

Define and own enterprise information security strategy, roadmap, and policies, and report to executives on risk posture, program maturity, and key initiatives.
Design, implement, and operate an ISO 27001-aligned ISMS, including scoping, Statement of Applicability, risk treatment plans, and Annex A controls, and drive the company toward ISO 27001 certification.
Own information security risk management, including the risk register, assessment methodology, risk acceptance and treatment processes, and recurring executive reporting.
Build and run security governance, including policies, standards, control ownership, exception handling, internal audit, control testing, and management reviews.
Operate the SOC 2 program alongside ISO 27001, map shared controls, own evidence collection, and manage external auditor and assessor relationships.
Establish enterprise security architecture for corporate cloud workloads, SaaS services, and corporate endpoints.
Build and operate vulnerability management, threat detection and response, and incident response for enterprise systems; select and operate EDR, SIEM, DLP, and email security tools; define playbooks; and lead tabletop exercises.
Own identity and access management governance with IT, including least privilege, SSO, MFA, conditional access, SCIM provisioning, privileged access management, and periodic access reviews.
Establish third-party security risk management and vendor security review processes, evaluating SaaS, cloud, and supply chain partners against contractual and regulatory security requirements.
Drive security awareness and training tailored to engineering, manufacturing, operations, and executive audiences.
Partner with the CIO to represent Apptronik in customer, partner, investor, and regulatory engagements, supporting security audits, due diligence, and enterprise security reviews.
Build, mentor, and grow a security and GRC team over time; initially work directly to design and implement controls.