Director of Security

Arrive Logistics•Austin, TX

3d•Onsite

About The Position

Arrive Logistics is seeking its senior-most security leader to own the company’s security strategy, operations, and audit readiness. Reporting directly to the VP of Enterprise IT, the Director of Security will lead day-to-day security, oversee the managed detection and response (MDR) relationship and security tools, and represent security across the business. The role will help strengthen audit capabilities and prepare Arrive for the scrutiny of a larger, more regulated company. This is a builder-minded leadership role focused on continuous improvement. The Director will assess the security team and program, identify gaps in skills, processes, and tools, and improve both the security posture and the people responsible for it. The role requires setting clear standards, making risk-based decisions that balance business speed and security, and holding partners and senior stakeholders accountable. The Director will own detection and incident response, vulnerability management, security standards for Arrive’s Azure-primary cloud environment, security testing, audit-readiness planning, AI security policy, third-party security risk management, and executive reporting. They will partner with Engineering on application security and DevSecOps standards, and with Infrastructure on identity security requirements and reviews.

Requirements

At least 12 years of experience in information security.
At least 5 years leading security teams and owning a security program at director level or above.
Proven record leading security through a growth cycle, managing SOX-relevant IT controls, and working with external auditors.
Deep GRC experience, including SOC 2, risk management, control design and testing, evidence management, and running audits from the security side.
Hands-on command of detection and response, including experience with an MDR provider and SIEM and running incidents under pressure.
Strong cloud security background, with Azure as the primary environment, plus endpoint, network, and identity security.
Application security and DevSecOps experience, including a record of setting standards adopted by Engineering teams.
Demonstrated ability to assess a team, identify skill and process gaps, and rebuild or upgrade the team to close them.
Executive presence and ability to brief executive leadership, the CFO, and auditors; explain risk in business terms; and challenge senior leaders with evidence.
Bachelor’s degree in computer science, cybersecurity, or information technology, or equivalent professional experience.

Nice To Haves

Security certifications such as CISSP, CISM, CISA, CRISC, or CCISO; equivalent experience is accepted.
Experience in logistics, transportation, brokerage, or another high-volume, partner-connected business.
Experience with AI governance and policy for enterprise AI tools.

Responsibilities

Own detection, monitoring, and incident response end to end, including the MDR relationship, SIEM use, and escalation paths into the service management workflow.
Set measurable incident response-time and quality standards, and lead post-incident reviews that improve operations.
Run vulnerability management and asset discovery as managed programs with clear owners, deadlines, and tracking.
Partner with Engineering leadership to define security standards and audit against them, while integrating security into software delivery.
Set security standards for the Azure-primary cloud environment and monitor security posture against those standards.
Make risk-based decisions about when to allow business activity to proceed and when to restrict it; escalate and drive execution when partners do not complete agreed remediation.
Own the security testing strategy, including external penetration-test scope and how automated testing results reach the security team.
Define audit-readiness requirements beyond the current SOC 2 Type II and build a roadmap to meet them.
Own AI security policy and contribute to governance of AI tools, including data access, usage visibility, and risk.
Set identity security requirements and review outcomes with Infrastructure, which owns the identity platform; enforce access standards, privileged access requirements, and review cadence.
Run third-party security risk management from intake and assessment through ongoing review, and manage customer security questionnaire responses through the team.
Review and improve how security work is generated, assigned, and prioritized, replacing ad hoc selection with a disciplined process.
Report security posture, risk, and progress to executive leadership in clear business terms.
Assess the security team, identify skills and process gaps, and rebuild or upgrade the team to address them.