Deputy Chief Information Security Officer
The Deputy Chief Information Security Officer will partner with the CISO to scale the security program, operating across application security, GRC, security operations, and cloud security. This senior leader will identify high-risk areas, support compliance initiatives, and represent the security program to internal and external stakeholders.
About the job
About the Role
Sardine is hiring a Deputy Chief Information Security Officer to partner closely with our CISO and help scale our security program as we grow.
This is a senior, high-impact role for a security leader who can operate across multiple areas, including application security, GRC, security operations, cloud and SaaS security, corporate IT, customer trust, and overall security strategy. You’ll serve as a trusted partner to the CISO, help identify and prioritize the highest-risk areas, and represent Sardine’s security program with internal teams, customers, prospects, auditors, and industry stakeholders.
We’re looking for someone who is broad, pragmatic, technically fluent, and comfortable in customer-facing settings. The right person can balance strong security judgment with the pace and trade-offs of a fast-moving startup.
What You’ll Do
- Partner with the CISO on Sardine’s overall security strategy, roadmap, priorities, and execution
- Help identify, prioritize, and address the highest-risk areas across the business
- Support security reporting, executive updates, budgeting, vendor evaluation, and planning
- Partner on key compliance initiatives, including PCI, SOC 2, ISO 27001, DORA, and future FedRAMP readiness
- Support incident response and act as a deputy incident lead when needed
- Work closely with Engineering on application security, secure SDLC, vulnerability management, threat modeling, and remediation
- Assess and improve security across cloud infrastructure, SaaS tools, IAM, endpoint management, and corporate IT systems
- Bring strong AppSec fluency, including understanding how code moves from design through production, CI/CD, testing, SAST/DAST, dependency scanning, and secrets management
- Partner with Product and Engineering on security considerations for AI/ML systems, bot mitigation, and abuse prevention
- Support customer-facing security conversations, RFPs, due diligence, security reviews, and executive briefings
- Help build trust with enterprise customers by translating technical security concepts into clear business language
- Partner cross-functionally with Legal, Sales, Engineering, Product, People, and IT
- Champion a pragmatic security culture that enables the business while managing risk
What We’re Looking For
- 10–15+ years of cybersecurity experience, including 3+ years in a senior leadership or director-level role
- Broad security background across multiple domains, not a single-specialty profile
- Strong application security experience and ability to assess technical risk without needing to be hands-on coding daily
- Experience operating in a startup, scale-up, or similarly resource-constrained environment where prioritization and pragmatism are critical
- Ability to evaluate risk, stack-rank priorities, and focus on the highest-impact security work
- Strong working knowledge of compliance frameworks such as SOC 2, PCI DSS, ISO 27001, GDPR, CCPA, DORA, and ideally FedRAMP
- Experience participating in or leading security incidents
- Strong cloud, SaaS security, IAM, endpoint security, and zero-trust fundamentals
- Familiarity with AI-assisted workflows and emerging AI/ML security risks
- Customer-facing communication skills, with the ability to support sales, security reviews, and executive-level customer conversations
- A collaborative, business-enabling approach to security — someone who helps teams find safe paths forward rather than defaulting to “no”
- Strong leadership presence and ability to build trust with security, engineering, executive, and go-to-market teams
- Experience in fintech, payments, security, bot mitigation, or regulated industries is a plus, but not required
- Must be based in the United States and authorized to work in the US without sponsorship
Benefits we offer:
- Generous compensation in cash and equity
- Early exercise for all options, including pre-vested
- Work from anywhere: Remote-first Culture
- Flexible paid time off and Year-end break
- Health insurance, dental, and vision coverage for employees and dependents - US and Canada specific
- 4% matching in 401k / RRSP - US and Canada specific
- MacBook Pro delivered to your door
- One-time stipend to set up a home office — desk, chair, screen, etc.
- Monthly meal stipend
- Monthly social meet-up stipend
- Annual health and wellness stipend
- Annual Learning stipend
- Join a fast-growing company with world-class professionals from around the world. If you are seeking a meaningful career, you found the right place, and we would love to hear from you.
Skills
Application Security, GRC, Security Operations, Cloud Security, Saas Security, IAM, Endpoint Management, Vulnerability Management, Threat Modeling, Incident Response, Pci Dss, SOC 2, ISO 27001, GDPR, CCPA
Similar jobs
Security Engineering jobs
Socure
San Francisco, CA
Leads company-wide information security, data governance, compliance, and risk programs while driving AI security strategy and executive-level governance. The role requires board presentation experience, enterprise customer engagement, vendor and supply chain risk expertise, and multiple security certifications.
Huntress
United States
Executive leader responsible for setting strategy and leading Huntress’s global Threat Detection & Response organization across SOC, incident response, detection engineering, threat hunting, and adversary tactics. Requires 10+ years in security leadership and 5+ years managing managers and directors.
Idme
Mountain View, CA
Leads ID.me’s Product Security program and security engineering team, partnering with Product and Engineering to reduce risk through practical, developer-aligned controls. Requires strong technical depth across application and cloud security, outcome-based leadership, and experience building security programs in fast-moving cloud-native environments.
GameChanger
United States
Leads GameChanger’s Information Security and Technology strategy, teams, roadmap, and risk decisions, with primary focus on product and application security. Requires 10+ years of security experience, broad security-program leadership, and experience managing technical leaders and partnering with Engineering and executives.
Exa
San Francisco, CA
Leads Exa’s company-wide security strategy, architecture, engineering, governance, incident response, and team development across AI infrastructure, cloud, products, and corporate systems. Requires executive-level security accountability and deep technical credibility in a rapidly scaling technology company.