Head of Security

Buyers Edge Platform; United States; Remote; USD 210,000 - 320,000; Full time

Benefits offered by this job

Medical benefits

401(k) with match

Remote-friendly

Job summary

Buyers Edge Platform is seeking a senior security leader to build and scale a comprehensive information security program across the US and Europe. You will own governance, risk, privacy, and compliance while directing vulnerability management, IAM, and incident response in a fast-growing, PE-backed environment.

You will lead a hybrid mix of in-house staff and partners, shaping security for a multi-brand platform and ensuring protections for data and operations, including AI safeguards and

Qualifications

• 12+ years in information security and 5+ years leading security teams or programs.
• Experience building or maturing security programs at scale (growth via acquisitions a plus).
• Proven governance, risk and compliance ownership including privacy and data protection.
• Familiarity with GDPR/UK GDPR, US state privacy laws and data processing agreements.

Responsibilities

• Define and execute the security program, roadmap and governance framework.
• Lead vulnerability management, secure SDLC, testing and pen testing.
• Oversee IAM, device policy, conditional access and remote workforce security.
• Develop incident response, forensics and tabletop exercises with executives.
• Drive privacy, risk reporting, SOC 2 scope and attestations across biz units.
• Provide AI security governance and tooling oversight.

Skills

Security leadership

Cloud security AWS

IAM & access mgmt

Vulnerability mgmt

Incident response

Governance & compliance

CISSP/CISM

Education

Bachelor's degree in a technical field

CISSP/CISM or similar

Job description

Buyers Edge Platform Reports to the Vice President, Information Technology Remote (US) with regular travel to our offices across the United States and Europe.

About Buyers Edge Platform

Buyers Edge Platform is the technology and procurement platform behind more than $100 billion of foodservice purchasing for roughly 300,000 restaurant, hospitality, healthcare and institutional locations. We are founder-led, private-equity backed, profitable, and growing through both organic expansion and acquisition. Our family of brands spans purchasing programs, supply chain software, fresh produce, business dining and restaurant back-office tools, and the technology underneath them is becoming one platform.

Why this role, why now

We move money, hold customer purchasing data and run software that our customers' operations depend on. As the company scales, security has to scale with it. We are building a dedicated security organization under our technology leadership, and the Head of Information Security is its first leader: the person who sets the program, owns governance and compliance across the US and Europe, builds the team, and makes security a shared standard across the platform and every acquired brand. This is a build role with executive sponsorship and budget.

What you will own

• The security program. Strategy, policies, standards and a risk-based roadmap, aligned to a recognized framework and reported to executive leadership on a regular cadence.
• Vulnerability and application security. A vulnerability management program with defined service levels, static and dynamic application testing, secure development practices with engineering, and penetration testing across customer-facing and internal systems.
• Identity, access and endpoint. Partnering with IT on identity and access management, device policy and conditional access, privileged access, and the security of a distributed, remote workforce.
• Detection and response. Monitoring, incident response and forensics, the incident playbook with Finance and Legal, and tabletop exercises with executive leadership.
• Governance, risk and compliance. You own the company's security and privacy governance and compliance program: the policy framework and its enforcement, risk register and risk reporting to executive leadership, SOC 2 and related attestations for the business units that need them, vendor and third-party risk, and security due diligence with a 100-day security plan for each acquisition. This includes privacy and data-protection compliance across our US and European operations, including GDPR and UK GDPR obligations, US state privacy laws such as CCPA, data-processing agreements with customers and vendors, cross-border data transfers, records of processing, data-subject requests, and breach-notification readiness, working with Legal and the business units.
• AI security. Governance for how employees and engineers use AI tools, data handling and model-access controls, security review of AI agents and integrations we build and buy, and defenses against AI-enabled attacks such as deepfake and business-email-compromise fraud.
• Awareness and culture. Security training and phishing resilience across the company, and a culture where engineers, operators and executives treat security as part of the job.
• The team. Hire and develop security engineers and analysts, and operate through a mix of in-house talent and trusted partners.

What success looks like in year one

• A written security program and roadmap, reviewed with executive leadership quarterly.
• Vulnerability service levels defined and met, with application security testing in the development lifecycle.
• Incident response playbook in place and exercised, with Finance and Legal in the loop.
• First external assessment complete and remediation underway; SOC 2 scope and timeline set for the business units that need it.
• A governance and compliance program in operation: policies adopted and enforced, risk register reviewed with leadership, and a privacy compliance baseline for GDPR and US state law documented and owned.
• AI usage governance published and in force.
• A security team hired and a partner model in place.

How you work

• You have built or substantially rebuilt a security program at a company of similar size, ideally one growing through acquisition.
• You are hands-on. You can read an architecture, review a finding and sit with an engineer, and you can also stand in front of a CEO, a CFO or a board and explain risk in business terms.
• You prioritize. You know the difference between what must be fixed this sprint and what belongs on a roadmap, and you set service levels engineers can meet.
• You lead through partnership with IT, engineering and the business, not through gates.
• You use AI tools in your own work and understand how they change both the defense and the threat.

What you bring

• 12+ years in information security, with 5+ years leading security teams or programs; Director or VP level, or equivalent.
• Depth in cloud security (AWS), identity and access management, application security and vulnerability management.
• Experience standing up or maturing a security program against a recognized framework (NIST CSF, SOC 2, ISO 27001 or similar).
• Ownership of governance, risk and compliance, including privacy and data-protection obligations under GDPR and US state privacy laws, in a company operating in both the US and Europe.
• Incident response leadership, including incidents with financial impact.
• Experience with security due diligence and integration for acquisitions.
• Bachelor's degree in a technical field or equivalent experience. CISSP, CISM, CRISC or comparable certification preferred; CIPP/E or CIPM a plus.

Nice to have

• Private-equity-backed or founder-led company experience.
• Payments, fintech or financial-controls exposure.
• Experience securing AI systems and agentic tooling.
• Foodservice or supply chain exposure.

Not sure you meet every qualification? Studies show that diverse applicants often hesitate to apply unless they check every box. At Buyers Edge Platform, we value authenticity and inclusion-if you're excited about the role, we encourage you to apply. You might be exactly who we're looking for!

What's in this for you:

• Great benefits from day one. We offer medical, dental, vision, FSA, company-paid life insurance, and more- plus a 401(k) with company match.
• Grow with us. Enjoy strong training, development, and competitive pay.
• Work-life balance. Our flexible PTO policy lets you take time when you need it- no accrual required.