Director of Cybersecurity & IT

About the role

Back Market, a global marketplace for refurbished devices, is looking for a Director of Cybersecurity & IT to define and lead the next phase of its security and technology operations maturity. Reporting to the VP of Platform Engineering, the role sits at the intersection of cybersecurity, IT, risk, compliance and business growth. It leads a multi-disciplinary organization through its existing functional managers, covering cybersecurity strategy and risk management, security operations, governance and compliance, IT operations, IT support and the corporate technology foundations. This is a director-level role focused on setting direction, developing leaders and making investment choices, not on owning every process personally.

Key responsibilities

• Set the strategy, roadmap and investment priorities for Cybersecurity & IT, aligned with the company's business goals, risk appetite and growth plans, and turn it into a focused portfolio of initiatives with clear outcomes and measures of success.
• Own the operating rhythm: planning, budgeting, program tracking, KPI and SLA reporting, risk reviews and executive communication.
• Make pragmatic investment and prioritization recommendations, and establish governance forums and decision mechanisms.
• Lead and grow the leadership team across Security Operations, Governance Risk & Compliance, IT Operations Engineering, IT Support and related security engineering or product security capabilities, including career paths, succession plans and development opportunities.
• Act as a trusted advisor to the VP of Engineering, CTO and executives, explaining security, IT and risk in clear business terms and partnering with Finance on investment cases, budget stewardship and vendor strategy.
• Own cyber risk management at the strategic level, escalate critical risks, and support compliance with ISO 27001, PCI DSS, GDPR, NIS2 and contractual requirements, working with the VP Legal and DPO on data privacy.
• Represent the company's security maturity to investors, auditors, regulators and partners, and serve as the senior escalation point for major security incidents.
• Integrate security into product and feature development, sponsor Product Security and secure software development practices, and set expectations for Security Operations, IT Operations and IT Support.
• Champion automation and engineering-led approaches, and foster a security-aware culture through communication, awareness and Security Champion programs.