Director, Security and Compliance

Twist Bioscience•South San Francisco, CA

8d•$251,263 - $265,592

About The Position

The Director of Security and Compliance is a strategic, highly technical leader responsible for designing, scaling, and overseeing Twist Bioscience’s global information security and regulatory compliance programs. Reporting to the CIO, the role bridges technical security engineering, legal requirements, and business operations. The director defines the security posture, leads Governance, Risk, and Compliance initiatives, and ensures continuous alignment with industry frameworks. The role translates regulatory policies into practical, testable technical controls that support engineering and business teams. The director leads framework strategy and monitoring, privacy compliance partnerships, enterprise risk assessments, security policy development, security operations oversight, incident response, and third-party risk management. The position manages internal and external audits, supports customer and sales security discussions, and reports risk metrics to executive leadership and the Board of Directors. The director also recruits, mentors, and manages security and compliance personnel and develops security awareness training. Twist Bioscience synthesizes genes from scratch using a silicon-based DNA Synthesis Platform. The company serves customers in health care, agriculture, industrial chemicals, and data storage. The California-based role offers base cash compensation of $251,263–$265,592, plus eligibility for a bonus, equity, and a benefits package. Compensation may vary based on candidate factors and location.

Requirements

Bachelor’s or master’s degree in Computer Science, Information Systems, Cybersecurity, Business, or equivalent practical experience.
At least 10 years of experience in information security, risk management, or compliance roles.
At least 5 years in a dedicated leadership or managerial capacity.
Strong familiarity with AWS or similar cloud environments.
Experience with modern compliance automation platforms such as Vanta, Drata, or Anecdotes.
Proven experience achieving and maintaining certifications such as SOC 2 Type II or ISO 27001 from the ground up.
Excellent verbal and written communication skills, including the ability to discuss log management with engineers and corporate risk with a non-technical board.

Nice To Haves

One or more relevant industry certifications, such as CISSP, CISM, CISA, CRISC, or CIPP.

Responsibilities

Lead the strategy, implementation, and ongoing monitoring of security frameworks, including SOC 2, ISO 27001, NIST CSF, PCI DSS, and HIPAA.
Partner with Legal counsel to support compliance with global privacy regulations such as GDPR and CCPA/CPRA.
Design and execute enterprise risk assessment programs, prioritize risks by business impact, and work with department heads on remediation plans.
Draft, update, and enforce company-wide information security policies and procedures that adapt to engineering workflows such as CI/CD pipelines and infrastructure-as-code.
Oversee security posture optimization with Security Engineering and IT Infrastructure, including infrastructure security, IAM, and data encryption.
Serve as a key leader on the Incident Response Team, coordinating investigations, mitigation, and required regulatory disclosures in the event of a breach.
Oversee vendor, software tool, and supply-chain security vetting to minimize external risk exposure.
Manage external and internal security audits, including evidence collection, auditor relationships, and reducing duplicate controls across frameworks.
Represent the company’s security posture to enterprise clients, review security questionnaires, and participate in prospective client calls.
Translate technical security data into business metrics for executive leadership and the Board of Directors.
Recruit, mentor, and manage security analysts and compliance professionals.
Develop and deliver security awareness training programs across business units.