• You'll own Hightouch's application security posture end-to-end. • Shape what security looks like here as we scale from 70 to 140+ engineers. • Solve hard problems at the intersection of security and distributed systems. • Improve our rate limiting, abuse detection, and granularity of access control. • Support our multi-region and multi-cloud backend, including launching Hightouch in new regions to support data residency requirements.

• Vulnerability management and offensive testing: Own the vuln lifecycle end-to-end — intake, triage, prioritization, risk acceptance, ticketing to dev teams, and remediation within SLA — and manage external pen tests and targeted assessments. Report regularly on status, SLA performance, and trends. • Security operations and incident response: Manage our MSSP partner for 24/7 SIEM and SOC monitoring; ensure telemetry, detections, and playbooks match our threat model. Serve as incident commander for real events, and run regular tabletops and post-incident reviews. • Policy, controls, and risk: Define and maintain Reach’s security policies and control framework. Design, implement, and measure the effectiveness of controls; maintain a risk register; and surface material risk decisions to leadership. • Compliance and audits: Own SOC 2 Type II and PCI DSS end-to-end with continuous control monitoring and evidence collection between audits. Serve as the primary contact for external auditors. • Application and cloud security: Partner with engineering on secure SDLC, threat modeling for new products and features, SAST/DAST/SCA coverage, and cloud security posture (IAM, configuration, workload protection). • Identity and access management: Own IAM policy, periodic access reviews, privileged access, and joiner/mover/leaver processes, in partnership with IT and People. • Third-party and customer security: Run Reach’s vendor risk program (due diligence, questionnaires, DPAs, ongoing monitoring) and own responses to customer and prospect security reviews. • Security awareness and training: Run phishing simulations, ongoing and role-targeted training, and regular company-wide sessions on new threats and best practices. • Executive reporting: Provide regular security posture updates with meaningful metrics (MTTD/MTTR, patch latency, control coverage, phishing outcomes, audit readiness). • People, budget, and tooling: Act as a mentor for your report; own the security budget and tool stack — evaluating, procuring, rationalizing, and retiring tools as the program matures.

• Team Leadership & Development: Mentoring, and growing security engineers. This includes running 1:1s, career development planning, performance reviews, and building a culture of continuous learning around evolving threats and technologies. • Security Execution: Partnering with engineers on your team and the Sr. Director of Security and Integrity you’ll define and prioritize the team's quarterly and annual security initiatives, aligning them with business objectives and frameworks like NIST CSF, CIS Controls, or SOC 2. Translating risk assessments into actionable engineering work. • Cross-Functional Collaboration: Partnering with Platform, SRE, Legal, IT, Compliance, and Product teams to embed security into the SDLC, incident response processes, and vendor management workflows. • Incident Response & Preparedness: You’ll help the team to maintain the Security incident response program: runbooks, running tabletop exercises, on call schedules, and ensuring timely response to alerts and events. • Product and Cloud Security: Drive product security practices and cloud security posture across our AWS infrastructure, ensuring secure architecture, configuration, and continuous monitoring of our production environments. • Vulnerability & Risk Management: Overseeing application security testing (SAST, DAST, SCA), penetration testing programs (including bug bounty), and ensuring vulnerabilities are triaged, prioritized, and remediated within SLA. • Corporate Security: Partnering with IT, you and the team will help ensure strong protections in corporate security including spam, EDR, and device security is mature and well executed. • Vendor & Third-Party Risk: Helping the team evaluating security vendors, and overseeing third-party risk assessments. • Budget & Resource Planning: In coordination with the other department managers; manage the security budget, justifying tooling spend, headcount requests.

• Develop and implement threat modeling to identify security risks across applications and infrastructure. • Conduct vulnerability scanning, penetration testing, and security assessments to detect weaknesses. • Define and enforce secure coding practices in collaboration with development teams. • Work with DevOps to integrate security into CI/CD pipelines and automate security testing. • Monitor and respond to security incidents, conducting root cause analysis and implementing preventative measures. • Ensure compliance with security standards and regulations (e.g., ISO 27001, GDPR, SOC 2). • Design and implement identity and access management (IAM) policies, encryption standards, and authentication mechanisms. • Collaborate with product teams to conduct security reviews of features, APIs, and third-party integrations. • Develop incident response plans, security documentation, and best practices. • Stay ahead of emerging threats, vulnerabilities, and security technologies.