Head of Security

Remote - Canada Full-time CA$222,000 - CA$293,000 / year

About the role

Super.com is seeking a Head of Security to lead its security function. Reporting to the Senior Director of Infrastructure Engineering, this strategic and technical role owns the security roadmap, team, risk management, and regulatory compliance. The role works with leaders across Legal, Data, Engineering, Product, Finance, and HR, and has access to the executive team and board.

About the team

The Security & IT organization covers IT, governance, risk and compliance (GRC), product security, and corporate security. The security engineering team, covering application and infrastructure security, reports directly to this role. The IT & Compliance function is led by a Director who also reports to the Head of Security.

Responsibilities

• Build the security organization by hiring engineers, GRC staff, and security operations partners; manage and mentor reports from junior individual contributors to Staff and Director level.
• Set security objectives and strategy across security domains.
• Mature GRC processes, including control frameworks, automated evidence, policy lifecycle, risk management, and privacy obligations in partnership with Legal.
• Develop an AI-first security program, including AI-native vulnerability management and detection tooling, and support safe adoption of AI.
• Build security culture through training, secure-by-default patterns, developer enablement, and clear security expectations.
• Guide security tooling, organizational structure, and team priorities to protect customers and products.
• Set technical direction and make final decisions on security architecture across Engineering.
• Be accountable to the board for security posture and risk acceptance.

Qualifications

• 10+ years of security experience, including 4+ years leading a security function or major pillar; experience managing managers, directors, and senior technical leaders.
• Experience owning company-level security strategy, budget, and outcomes at a fast-paced technology company.
• Hands-on experience in at least two of application or product security, infrastructure security, detection and incident response, enterprise IT and identity, or GRC.
• Experience scaling GRC programs, including control frameworks, evidence automation, policy, and privacy program management; familiarity with SOX, GDPR, PCI, SOC 2, or ISO 27001.
• Experience presenting to and working with a board or audit committee, and with external auditors, regulators, or QSAs.
• Experience quantifying and accepting security risks and communicating technical risk in business terms.
• Track record of hiring security professionals and developing technical and people leaders.
• Professional experience driving AI transformation in security, engineering, or IT organizations.

Technology

The technology environment includes Kubernetes-based microservices, Python FastAPI, TypeScript and React, Postgres, Redis, Kafka, Elasticsearch, Snowflake, and AWS. Infrastructure technologies include EKS, MSK, ElastiCache, RDS, Istio, Helm, Terraform, Crossplane, and Kyverno. Security and application logs, metrics, and events are managed through Datadog.

Location and compensation

Remote role open in Canada and the United States. Canadian compensation is listed as CA$222,000–CA$293,000, depending on geographic tier, with equity and bonus. The posting also describes remote-first flexibility, unlimited PTO, recharge days, parental leave, wellness and development budgets, and other benefits.