Director, Security Operations

Squarespace•New York, NY

2d•Hybrid

About The Position

Squarespace is seeking a skilled and detail-oriented leader to help with the Security team daily operations. You will report directly to the VP of Security / CISO and partner with teams throughout the organization to iteratively improve our security posture and programs. You will also lead the implementation of new security programs. This role will be based in our NY headquarters and hybrid (3x week). You'll Get To… Strategic & Programmatic: Contribute to define, collect, and analyze security KPIs and KRIs for the security organization. Mentor and support more associate team members Develop and implement a comprehensive security operations strategy and roadmap aligned with Squarespace's overall our goals and risk appetite. This goes beyond just "implementing new security programs" to encompass a holistic vision. Oversee the Security Operations Center (SOC) activities, including threat detection, monitoring, analysis, and proactive hunting, ensuring 24/7/365 coverage as appropriate. Establish and maintain a robust incident response program, including defining incident playbooks, leading major incident investigations, and conducting post-incident reviews to drive continuous improvement. Manage and enhance the vulnerability management program, from identification and assessment to prioritization and remediation tracking across all Squarespace assets. Lead efforts in security architecture review and design consultation for new products, features, and infrastructure changes to ensure security is built-in from the outset. Identify, evaluate, and implement new security technologies and tools to enhance detection, prevention, and response capabilities. Drive continuous improvement of security operations processes through automation, tooling, and best practices. Stay abreast of emerging security threats, vulnerabilities, and industry trends and proactively advise leadership on necessary adjustments to strengthen Squarespace's security posture. Contribute to the development and enforcement of security policies, standards, and guidelines across the organization. Leadership & Collaboration: Build, mentor, and lead a high-performing team of security professionals, fostering a culture of continuous learning, collaboration, and accountability. This explicitly states the "building" aspect of a team. Act as a key liaison and trusted advisor to internal stakeholders (e.g., Engineering, Product, Legal, Compliance, IT) on security-related matters. Manage relationships with external security vendors and partners, ensuring effective service delivery and technology adoption. Oversee security compliance activities related to relevant regulations (e.g., GDPR, PCI-DSS) and frameworks (NIST, ISO 27001), ensuring Squarespace's adherence. Promote a culture of security by design by working closely with development teams to integrate security into the software development lifecycle (SDLC). Work with partner teams to implement new security programs and refine existing ones, with an emphasis on driving the team's velocity while also maintaining high customer and employee engagement.

Requirements

Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience).
12+ years of experience in cybersecurity, with a passion for Authentication and Authorization.
Strong knowledge of Linux operating systems and cloud platforms (AWS & GCP).
Experience with tools automation tools for automating intake complaints and concerns from customers.
Familiarity with frameworks such as NIST, CIS, ISO 27001.
Adept and well versed in collaborating with stakeholders across organizational boundaries.
Knowledge of all areas of Security: GRC, IR, Vulnerability management, and product security, etc.
Knowledge of software development, design and technical operations.
Experience with Domain or website abuse processes.

Responsibilities

Contribute to define, collect, and analyze security KPIs and KRIs for the security organization.
Mentor and support more associate team members
Develop and implement a comprehensive security operations strategy and roadmap aligned with Squarespace's overall our goals and risk appetite.
Oversee the Security Operations Center (SOC) activities, including threat detection, monitoring, analysis, and proactive hunting, ensuring 24/7/365 coverage as appropriate.
Establish and maintain a robust incident response program, including defining incident playbooks, leading major incident investigations, and conducting post-incident reviews to drive continuous improvement.
Manage and enhance the vulnerability management program, from identification and assessment to prioritization and remediation tracking across all Squarespace assets.
Lead efforts in security architecture review and design consultation for new products, features, and infrastructure changes to ensure security is built-in from the outset.
Identify, evaluate, and implement new security technologies and tools to enhance detection, prevention, and response capabilities.
Drive continuous improvement of security operations processes through automation, tooling, and best practices.
Stay abreast of emerging security threats, vulnerabilities, and industry trends and proactively advise leadership on necessary adjustments to strengthen Squarespace's security posture.
Contribute to the development and enforcement of security policies, standards, and guidelines across the organization.
Build, mentor, and lead a high-performing team of security professionals, fostering a culture of continuous learning, collaboration, and accountability.
Act as a key liaison and trusted advisor to internal stakeholders (e.g., Engineering, Product, Legal, Compliance, IT) on security-related matters.
Manage relationships with external security vendors and partners, ensuring effective service delivery and technology adoption.
Oversee security compliance activities related to relevant regulations (e.g., GDPR, PCI-DSS) and frameworks (NIST, ISO 27001), ensuring Squarespace's adherence.
Promote a culture of security by design by working closely with development teams to integrate security into the software development lifecycle (SDLC).
Work with partner teams to implement new security programs and refine existing ones, with an emphasis on driving the team's velocity while also maintaining high customer and employee engagement.