Mô tả công việc
Job Summary
Social Discovery Group (SDG) is looking for a CISO Mentor to join the team for several hours per month.
Responsibilities
- Improve and maintain perimeter and network-layer defenses (WAF, Rate Limiting, Anti-bot, DDoS mitigation)
- Secure product APIs against abuse and anomalous traffic
- Strengthen authentication, authorization, and access control at the product level, including IDOR-class issues
- Run the Vulnerability Management process: identification, prioritization, and remediation tracking
- Coordinate external pentests and drive remediation of findings
- Lead Incident Response for product security incidents
- Build detection and response processes together with the monitoring team
- Contribute to Fraud & Trust and Safety initiatives with relevant teams
- Protect customer data at the product level (access control, encryption, masking)
- Run the Security Champions program to train product teams on secure development
- Manage the Bug Bounty program
Requirements
- 7+ years in senior Information Security leadership (CISO, VP of Security, or Head of InfoSec) with a proven track record of mentoring or advising emerging security leaders
- Proven experience building, scaling, and managing an Information Security program entirely from scratch for a startup or scaling enterprise
- Deep, practical knowledge of operating in heavily regulated markets (FinTech, HealthTech, GovTech) and successfully leading organizations through rigorous audits (SOC 2 Type II, ISO 27001, PCI-DSS, HIPAA, or GDPR)
- Strong architectural understanding of securing high-throughput, highly available, distributed systems and cloud-native environments (AWS/GCP/Azure) without bottlenecking performance
- Ability to teach and establish risk management frameworks, compliance roadmaps, and vendor risk management processes
- Exceptional ability to translate complex technical risks into business impacts, and experience coaching others on how to present security strategies to C-level executives and the Board of Directors
- Experience establishing and commanding an enterprise-grade Incident Response plan, including crisis management and post-breach communications
- Demonstrated ability to foster a "security-first" culture across engineering, product, and business teams
- Fluent Russian