Full Time Head of Security Jobs, in CETTIRE - Maukerja

About Us

We're a publicly listed global luxury e-commerce technology leader, combining global scale with startup agility. Our technology platform powers revenue-critical systems serving customers across more than 50 countries.

Why Join Us

You’ll join CETTIRE at a defining moment: building our security capability from the ground up while expanding the use of AI across our products and business workflows. You’ll shape the guardrails that allow teams to move quickly and innovate with confidence.

This is a high-impact individual contributor role: you will set the security strategy, establish the operating model and personally lead the most important technical work.

With direct access to senior leadership, you’ll work closely with engineering, infrastructure, data and business teams. You’ll have genuine ownership, fast decision-making and the opportunity to use modern cloud security, developer tooling and AI/cloud agents to protect revenue-critical systems operating at global scale.

What You'll Protect

You'll own the security of CETTIRE's technology environment end to end, including:

• Customer-facing websites, APIs and e-commerce applications
• Software development environments, source code, CI/CD pipelines and software supply chain
• AI models, agents, data and integrations used across products and business workflows
• Product, pricing and commercial data, including protection against bots, scraping, and data exfiltration
• AWS and other cloud infrastructure, workloads, identities and networks
• Customer, commercial and employee data across its lifecycle
• Corporate IT, endpoints, identity, SaaS applications and third-party access
• Security monitoring, incident response, vulnerability management and business continuity

What You'll Do

Strategic Ownership of Information Security

• Define CETTIRE's enterprise and product security strategy, target architecture, roadmap and standards, aligned with business priorities and material risks.
• Define and enforce company-wide security policies covering responsible AI use, data handling, access and secure engineering, translating them into practical controls, ownership and monitoring.
• Establishing guardrails for data use, model and agent access, third-party tools and drive ongoing risk monitoring.
• Enable the secure adoption of AI across CETTIRE's products and business workflows
• Use developer-oriented tooling (DOT), cloud agents and AI/agentic automation to improve security engineering, detection, investigation, remediation and evidence collection.
• Remain deeply hands-on while setting security direction and advising teams on emerging risks and responsible technology adoption.

Product & Platform Security

• Embed secure-by-design practices throughout the software development lifecycle, including threat modelling, secure design and code review, dependency and secrets management, automated scanning and release controls.
• Develop scalable protections against bots, scraping and automated abuse while preserving legitimate customer and partner access.
• Harden AWS through strong identity boundaries, least privilege, secure network architecture, encryption, logging, posture management and automated guardrails.
• Strengthen website, checkout and API security through vulnerability management, penetration testing, Content Security Policy, third-party script governance and continuous exposure reviews.
• Own security testing and vulnerability management, prioritising remediation according to exploitability, exposure and business impact.

Security Operations & Enterprise Protection

• Build practical detection and incident-response capabilities across cloud, applications and corporate IT, supported by tested playbooks and disciplined remediation.
• Protect sensitive data through classification, access controls, encryption, retention, monitoring and privacy-by-design practices.
• Strengthen workforce identity, endpoint, email, SaaS and privileged-access security, including joiner-mover-leaver controls.
• Assess suppliers and technology partners, establish proportionate security requirements and manage material third-party risks.

What Success Looks Like

• CETTIRE has a clear, prioritised security roadmap grounded in business risk and supported by leadership.
• Material risks across the customer platform, development lifecycle, cloud, data and corporate IT are understood, owned and measurably reduced.
• Security and quality controls run automatically in developer workflows and CI/CD, covering dependencies, secrets, code, infrastructure and deployable artifacts, with proportionate gates that reduce risk without unnecessary delivery friction.
• CETTIRE can detect, investigate and respond effectively to security incidents, with clear ownership and tested playbooks.
• Engineering and business teams view security as a pragmatic partner that enables safe, fast execution.

Qualifications

Professional Experience

• 12+ years of broad information security experience, with a strong security-engineering foundation and experience across multiple areas such as product/application, cloud, infrastructure and enterprise security; including at least three years setting security strategy and leading its implementation across an organisation or business unit.
• Track record of building or transforming security capabilities in a fast-moving internet, e-commerce or technology environment.
• Comfortable moving between strategy and implementation, exercising sound risk judgement and influencing senior leaders and experienced engineers.
• Excellent written and verbal communication skills in English.

Technical Security Expertise

• Demonstrated strategic ownership of information security, including defining enterprise security strategy, target architecture, policies, operating model and roadmap, and translating them into measurable, risk-prioritised execution.
• Practical experience with security architecture, threat modelling, vulnerability management, penetration testing, software supply-chain security and incident response.
• Strong application and product security experience across web applications, APIs, payment journeys, distributed systems and modern CI/CD.
• Deep hands-on expertise securing AWS or comparable cloud-native environments, including identity, networks, containers, data, observability and infrastructure as code.
• Strong understanding of identity, endpoint and SaaS security, data protection, secrets and key management, and zero-trust principles.
• Ability to help engineering introduce pragmatic automated testing and delivery controls that improve security and release confidence.

AI, Automation & Credentials

• Demonstrated experience using developer-oriented tooling (DOT), cloud agents and AI/agentic automation to improve security engineering, detection, investigation and remediation.
• Relevant certifications such as CISSP, CCSP, AWS Security Specialty or OSCP are valued but not required.

Privacy and Fairness at CETTIRE

CETTIRE is committed to an inclusive, fair and transparent recruitment process. We may use AI tools to support application screening and candidate matching, but these tools do not replace human judgment as final decisions are made by our team. We handle your personal information securely and take steps to prevent unfair or discriminatory outcomes. For questions about your data or our recruitment process, contact *************.