Director of Information Security

Constructor

1d • Remote

About The Position

As Director of Information Security, you will own Constructor's security program end-to-end — protecting our platform, our customers' data, and our team. You'll report to the CIO and serve as the company's senior security leader, responsible for everything from compliance frameworks and incident response to hands-on prospect engagements and internal policy. This is a high-autonomy role where you'll shape strategy and execute it yourself in a lean, engineering-driven organization. Constructor is the only search and product discovery platform tailor-made for enterprise ecommerce where conversions matter. Constructor's AI-first solutions make it easier for shoppers to discover products they want to buy and for ecommerce teams to deliver highly personalized experiences that drive impressive results. Optimizing specifically for ecommerce metrics like revenue, conversion rate and profit, Constructor generates consistent $10M+ lifts for some of the biggest brands in ecommerce, such as Sephora, Petco, home24, Maxeda Brands, Birkenstock and The Very Group. Constructor is a U.S. based company that was founded in 2015 by Eli Finkelshteyn and Dan McCormick.

Requirements

• 5+ years of experience in information security, with at least 2 years in a senior or leadership role
• Proficiency with AI tools like Claude Code
• Deep familiarity with compliance frameworks (SOC 2, ISO 27001, GDPR, CCPA)
• Experience owning incident response end-to-end in a SaaS or cloud-native environment
• Comfortable in customer-facing settings — you can clearly articulate security posture to enterprise prospects
• Hands-on experience with identity management (Okta or similar), MDM, DLP, and cloud security tooling
• Strong understanding of application security in a modern stack
• Excellent English written communication — you'll author policies, questionnaire responses, and board-level summaries
• Ability to operate independently with minimal oversight in a fully remote culture

Nice To Haves

• CISSP, CISM, or equivalent certification preferred but not required

Responsibilities

• Answer prospect security questions, review and finalize security questionnaires, and meet directly with prospects and customers to represent Constructor's security posture
• Own SOC 2 Type II and ISO 27001 certification programs, manage external auditors, maintain controls, and ensure continuous compliance
• Own all security incidents from detection through resolution and post-mortem; maintain and improve the incident response plan
• Conduct ongoing risk assessments, maintain the risk register, and present risk posture to leadership and the board
• Run quarterly access reviews across all systems; ensure least-privilege principles are enforced
• Field "Can I use this?" questions from employees evaluating new tools, vendors, and workflows
• Define and maintain guardrails for internal AI use, balancing productivity with data protection
• Plan and execute tabletop exercises, simulated incidents, and red/purple team engagements
• Oversee the data loss prevention program, triage alerts, and refine policies
• Review third-party vendor security posture and manage the vendor risk assessment process
• Maintain the employee security training program and foster a security-conscious culture
• Collaborate with Platform Engineering on cloud security posture (AWS), container security, and vulnerability management

Benefits

• Unlimited vacation time -we strongly encourage all of our employees take at least 3 weeks per year
• A competitive compensation package including stock options
• Fully remote team - choose where you live
• Work from home stipend! We want you to have the resources you need to set up your home office
• Apple laptops provided for new employees
• Training and development budget for every employee, refreshed each year
• Parental leave for qualified employees
• Work with smart people who will help you grow and make a meaningful impact

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed