Director of Enterprise Security

Apptronik; Austin (TX); On-site; USD 180,000 - 280,000; Full time

Job summary

Apptronik is seeking a Director of Enterprise Security to build and lead the information security program. You will own risk management, governance, and the ISMS to drive ISO 27001 certification while partnering with IT, legal, HR, finance, and operations.

You will architect enterprise security across cloud, SaaS, and endpoints, lead incident response, and ensure compliance with NIST, CIS, GDPR/CCPA in a growing robotics company.

Qualifications

• 12+ years of information security experience with leadership roles.
• Strong ISO 27001 implementation and ongoing ISMS management experience.
• Experience scaling security at high-growth hardware/robotics/manufacturing companies is a plus.

Responsibilities

• Define and own enterprise information security strategy, roadmap, and policies with executive reporting.
• Design and operate an ISO 27001 ISMS and drive certification readiness.
• Build security governance, risk management, and vendor security review processes.
• Operate SOC 2 program in parallel with ISO 27001 and coordinate with auditors.
• Lead threat detection, response capabilities, and incident playbooks.

Skills

ISO 27001

ISMS lifecycle

Risk management

SOC 2

Cloud security

IAM

Incident response

Security governance

Executive briefing

Vulnerability management

Education

Bachelor's degree in Computer Science, Information Security, Engineering, or related field

Master's degree (MS in Information Security, MBA with security focus) is a plus

Active senior security certifications (CISSP, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, GIAC) strongly preferred

Job description

Apptronik is a human-centered robotics company developing AI-powered robots to support humanity in every facet of life. Our flagship humanoid robot, Apollo, is built to collaborate thoughtfully with people, starting with critical industries such as manufacturing and logistics, with future applications in healthcare, the home, and beyond.

We operate at the cutting edge of Applied AI, applying our expertise across the full robotics stack to solve some of society's most important problems. You will join a team dedicated to bringing Apollo to market at scale, tackling the complex challenges like safety, commercialization, and mass production to change the world for the better.

JOB SUMMARY

As Apptronik scales its humanoid robotics business, we are seeking a Director of Enterprise Security to build and lead our enterprise information security program. Reporting to the Director of IT, the CISO will own Apptronik's risk management and governance frameworks and drive the company toward ISO 27001 certification. This role is focused on enterprise security protecting corporate systems, data, identities, and SaaS estate. The successful candidate is a pragmatic security professional who can translate framework requirements into clear policy and well-prioritized controls, stand up an ISMS quickly, and partner effectively with IT, legal, HR, finance, and operations leaders.

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Define and own Apptronik's enterprise information security strategy, roadmap, and policies, with clear executive-level reporting on risk posture, program maturity, and key initiatives
• Design, implement, and operate an ISO 27001-aligned Information Security Management System (ISMS) — including scoping, Statement of Applicability, risk treatment plans, and the full set of Annex A controls — and drive Apptronik to ISO 27001 certification
• Own information security risk management — establish the information security risk register, risk assessment methodology, risk acceptance and treatment processes, and recurring reporting to executive leadership
• Build and run the security governance program — policies, standards, control ownership, exception handling, internal audit, control testing, and management review cadence
• Operate the SOC 2 program in parallel with ISO 27001, mapping shared controls, owning evidence collection, and managing relationships with external auditors and assessors
• Establish the enterprise security architecture across cloud for corporate workloads, SaaS estate, and corporate endpoints
• Build and run vulnerability management, threat detection and response, and incident response capabilities for enterprise systems — selecting and operating EDR, SIEM, DLP, and email security tooling; defining playbooks; and leading tabletop exercises
• Own identity and access management governance in partnership with IT — enforcing least-privilege, SSO, MFA, conditional access, SCIM provisioning, privileged access management, and periodic access reviews across all enterprise systems
• Establish third-party security risk management and vendor security review processes; evaluate SaaS, cloud, and supply chain partners against contractual and regulatory security requirements
• Drive security awareness and training programs across the company, tailored to engineering, manufacturing, operations, and executive audiences
• Partner with the CIO to represent Apptronik in customer, partner, investor, and regulatory engagements, supporting security audits, due diligence, and enterprise security reviews.
• Build, mentor, and grow a high-performing security and GRC team over time; in the near term, operate as a working leader who designs and implements controls directly

SKILLS AND REQUIREMENTS

• 12+ years of progressive information security experience, including 5+ years leading enterprise security programs as a Director, Head of Security, or senior security leadership role.
• Deep, demonstrated fluency with ISO 27001 — including the ISMS lifecycle, scoping, Statement of Applicability, risk assessment methodology, and end-to-end implementation of Annex A controls
• Track record of building enterprise security programs from the ground up at high-growth companies and driving them through ISO 27001 certification (and ideally SOC 2 Type I/II in parallel)
• Strong expertise in risk management and governance — risk registers, risk treatment, control frameworks, policy development, exception handling, internal audit, and executive-level risk reporting
• Strong working knowledge of additional frameworks and regulations as relevant — NIST CSF, NIST 800-53, CIS Controls, GDPR, CCPA, and export controls (ITAR/EAR preferred) given the robotics context
• Hands-on architectural depth across cloud platforms (AWS, GCP, and/or Azure) for corporate/enterprise workloads, including IAM, network security, encryption, and logging
• Strong identity and access management expertise — Okta, SSO, MFA, conditional access, SCIM, lifecycle management, and privileged access controls
• Endpoint and corporate IT security experience across Linux, macOS, and Windows — MDM (Jamf, Intune), EDR, disk encryption, patch and configuration management
• Experience operating detection and response capabilities — SIEM, EDR, log pipelines, threat intelligence, and incident response — including leading real incidents end-to-end
• Demonstrated ability to translate framework requirements into pragmatic, well-prioritized controls without slowing the business unnecessarily
• Excellent written and verbal communication skills, including the ability to brief executives and the board, write clear policy, and engage external auditors and customers
• Strong leadership presence — sound judgment, calm under incident pressure, and the ability to build trust quickly across IT, legal, HR, finance, and operations

NICE TO HAVE

• Industry certifications such as CISSP, CISM, CISA, CCSP, ISO 27001 Lead Implementer or Lead Auditor
• Experience leading enterprise security at a hardware, robotics, manufacturing, automotive, or aerospace company
• Experience with GRC platforms (e.g., Vanta, Drata, OneTrust, ServiceNow GRC) to operationalize ISMS evidence and control monitoring
• Experience with additional frameworks such as NIST CSF audits, HITRUST, PCI-DSS, or TISAX
• Experience operating in environments subject to ITAR/EAR export controls or working with U.S. government / defense customers
• Prior experience scaling a security and GRC team from individual contributor to multi-discipline organization

EDUCATION and/or EXPERIENCE

• 12+ years of information security experience required, with substantial time in security leadership roles; Bachelor's degree in Computer Science, Information Security, Engineering, or a related field preferred — equivalent experience accepted
• Master's degree (e.g., MS in Information Security, MBA with security focus) is a plus
• Active senior security certifications (CISSP, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, GIAC) strongly preferred

PHYSICAL REQUIREMENTS

• Prolonged periods of sitting at a desk and working on a computer
• Periodic travel between Apptronik sites, customer locations, and industry events
• Vision to read printed materials and a computer screen
• Hearing and speech to communicate

*This is a direct hire. Please, no outside Agency solicitations.

Technology Control Restrictions: As a person in this position will have access to technical data and/or computer software maintained by the Company, which includes export-controlled technical data and/or computer software, successful applicants must be eligible under U.S. export control regulations to access such information.

Apptronik provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Apptronik’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval, or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.