Head of Security and IT

Cardlytics • CO Remote, CO

8d • Remote

About The Position

Cardlytics is looking for a Head of Security & IT to lead the team responsible for protecting and operating the technology that runs our business. This is a hands-on leadership role: you will set strategy and represent the program to executives, our board, and bank partners like Chase and Wells Fargo, while staying close enough to the work to step in when needed. You will lead a team of five covering security engineering, IT engineering, network engineering, security compliance, and end-user support, our identity and access management program, and the resilience of our AWS-hosted production environment.
Cardlytics is subject to strict compliance oversight from public-company (SOX) requirements and publishing partners (including major financial institutions). This role exists to make sure security and IT are never the reason the business slows down — and increasingly, to make sure the company is using AI to work faster and smarter.
You'll have real executive visibility — direct partnership with the CTO, exposure to the board, and a seat at the table on how Cardlytics adopts AI company-wide. It's a lean, high-trust team where your judgment matters more than process for process's sake, and where leadership is actively investing in modernizing how the function operates.

Requirements

• 8+ years in security and/or IT leadership, including 3+ years managing a team directly.
• Deep, hands-on background in at least two of: security engineering, security architecture, identity & access management, or vulnerability management — you can read technical output and challenge it, even if you're not writing production code day to day.
• Direct experience owning or heavily supporting SOX and/or SOC 2 compliance programs, including working with external auditors.
• Experience with modern IAM tooling (Okta, Google Workspace, or similar) and cloud security platforms (Wiz or comparable CNAPP/CSPM).
• Comfort operating in a fully remote, lean-team environment where you'll rely upon managed/third-party providers rather than building everything in-house.
• Working knowledge of AWS and IaC concepts (Terraform) sufficient to have informed conversations with engineering — you don't need to write it yourself.
• Executive-level communication skills: able to translate technical risk into business terms for a CTO, board, and bank auditors.
• Genuine enthusiasm for applying AI tools to security, IT, and compliance workflows — and for helping non-technical teams do the same.
• Primarily use macOS and Google Workspace (Docs, Sheets, Slides). Familiarity with or willingness to work within this environment is required.

Nice To Haves

• Experience in fintech, adtech, or another environment with heavy third-party/bank compliance scrutiny— valued, not required.
• Familiarity with Databricks, EKS, or MDR/managed-SOC relationships (e.g., Expel or similar)— valued, not required.
• A security or compliance certification (CISSP, CISM, or equivalent) — valued, not required.

Responsibilities

• Own the SOX/SOC 2 control environment for engineering and GUARD (our internal security/compliance program); serve as the primary point of contact for external auditors, internal audit, and third-party risk assessments from bank partners.
• Oversee and improve the identity and access management program across Google Workspace, Okta, and ConductorOne; ensure least-privilege access is enforced and evidenced for audit.
• Maintain the cloud security baseline across our 100% AWS production environment (EKS, Lambda, Terraform, GitHub Actions); partner with Engineering to triage and remediate findings surfaced through Wiz and Expel (our MDR provider covering CloudTrail, GuardDuty, Wiz Defend, SentinelOne, and Databricks).
• Act as an internal champion for AI adoption beyond engineering — helping non-technical teams identify safe, effective use cases, and modeling how the security/IT function itself uses AI to move faster (e.g., in compliance evidence-gathering, access reviews, and incident response).
• Ensure reliable, secure device management for a hybrid Windows/macOS remote workforce, a healthy BYOD mobile posture, and responsive IT help desk support company-wide.
• Ensure SSL/TLS certificate renewal, network resilience, and general network hygiene practices are proactive, not reactive.
• Manage and develop a 5-person team; set priorities, review work, and be capable of personally covering any team function during absences.
• Work closely with the CTO to align security/IT priorities with business strategy; communicate risk and program status clearly to non-technical executives and the board.

Benefits

• Flexible paid time off plus company holidays
• Medical, dental, and vision insurance begins on your first day
• 401(k) retirement plan with company match, plan also includes a student loan debt repayment option
• Employee Stock Purchase Plan
• Educational assistance for continuing education
• Lifestyle Spending Account for physical, emotional, and financial wellness (like gym memberships, home down payments, art classes, park passes, and more!)
• Complimentary Calm app subscriptions to support employee mental health and wellbeing

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed