Chief Information Security Officer (CISO)

Description

About Us:

RunBuggy is the most technically advanced automotive logistics platform on the market. Period.

Backed by Porsche Ventures and Hearst Ventures, RunBuggy is transforming the way cars move. Our cutting-edge technology is trusted by some of the largest OEMs, captive finance companies, and automotive lenders in the world to streamline vehicle transportation at scale.

RunBuggy’s end-to-end platform connects car shippers and haulers in real time - eliminating the friction of traditional load boards and costly custom software. For shippers, RunBuggy integrates directly into existing management systems, reducing transportation costs and accelerating delivery timelines. For transporters, we offer a smarter, more profitable way to find, accept, and manage loads - all from a single app.

Since launching in 2019, RunBuggy has grown to over 190 team members, facilitated the movement of hundreds of thousands of vehicles, and attracted tens of thousands of transporters across the U.S.

We’re not just building a better logistics platform - we’re redefining the future of automotive transportation.

About the Role:

The Chief Information Security Officer provides enterprise leadership for the company’s cybersecurity, risk management, compliance, IT infrastructure, end-user technology operations, and enterprise data governance. This executive role is responsible for ensuring the company’s technology environment is secure, resilient, scalable, and aligned with business priorities, regulatory obligations, and the company’s risk tolerance.

The successful candidate will be a seasoned, business-minded, hands-on security executive with proven experience leading cybersecurity strategy, incident response, governance, cloud security, regulatory compliance, IT operations, data governance, fraud prevention, and high-performing teams. This individual will act as both a strategic advisor and an operational leader, working proactively with product and engineering teams to secure the platform, anticipate threats, and protect the business from cyber, physical-theft, fraud, and organized-crime risks.

This is a hybrid role based out of Tempe, AZ. Please do not apply if you are unable to work in-office 2-3 days per week.

If this sounds just like you, then please read on! If you feel this is not in your wheelhouse, that is okay too! We are actively hiring outstanding professionals, so we encourage you to apply to one of our many other opportunities.

What You Will Be Doing:

Security Strategy and Leadership

• •Set and lead the company’s enterprise cybersecurity strategy, priorities, policies, standards, and operating plans.
• •Advise executive leadership and the board on cybersecurity risk, business impact, investment priorities, and emerging threats.
• •Take a hands-on, offensive security posture by anticipating threat activity, challenging assumptions, and driving proactive risk reduction across the business.
• •Promote a companywide security culture through education, awareness, and accountable business practices.

Governance, Risk, and Compliance

• •Lead security governance, risk, compliance, audit readiness, and regulatory alignment across the enterprise.
• •Oversee processes to identify, assess, prioritize, mitigate, and report information-security risks.
• •Maintain compliance with applicable laws, regulations, and security frameworks, including SOC 2, ISO 27001, NIST, PCI DSS, HIPAA, GDPR, or other relevant standards.
• •Manage third-party security risk and partner with Legal and Compliance on privacy, data protection, data governance, contracts, and regulatory matters.

Security Operations and Resilience

• •Oversee core security operations, including monitoring, vulnerability management, identity and access management, endpoint security, application security, cloud security, and threat intelligence.
• •Establish, test, and continuously improve incident-response, disaster-recovery, and business-continuity plans.
• •Lead response to significant security incidents, including executive, customer, regulator, law-enforcement, and stakeholder communications as appropriate.
• •Partner with Operations, Legal, Compliance, and law enforcement as appropriate to prevent, investigate, and respond to physical theft, fraud, organized-crime activity, and related security threats.

Product, Application, and Infrastructure Security

• •Work directly with Product and Engineering to embed secure-by-design practices into the platform, product roadmap, software delivery, technology architecture, and cloud environments.
• •Partner with Engineering and IT to strengthen infrastructure, network, application, data, and platform security.
• •Lead hands-on offensive security efforts, including penetration testing, red-team exercises, abuse-case reviews, security assessments, code reviews, and remediation programs.
• •Support secure adoption of emerging technologies, including artificial intelligence and automation.

Enterprise Data Governance

• •Own the company's enterprise data governance strategy, including data classification, quality standards, retention, disposal, and metadata management, ensuring data assets are inventoried and protected in accordance with company policy and applicable law.
• •Partner with Legal, Compliance, Product, and Engineering to align data governance practices with applicable privacy laws, contractual obligations, and regulatory requirements across all business functions.

IT Infrastructure and Helpdesk Operations

• •Oversee reliable, secure IT infrastructure and end-user technology services, including networking, cloud storage, device management, identity and access, backups, and recovery.
• •Manage IT service providers, managed-service providers, and technology vendors to ensure performance, accountability, and value.
• •Coordinate infrastructure changes, maintenance windows, upgrades, and planned service interruptions to minimize business disruption.

Team and Program Development

• •Build, lead, and develop a high-performing security and IT team with clear roles, accountability, and talent strategy.
• •Establish performance metrics, service-level expectations, operating procedures, budgets, and investment priorities.
• •Foster strong collaboration across security, engineering, IT, compliance, privacy, legal, product, operations, and business teams.

Additional Responsibilities

• •Other duties as assigned.
• •This position supervises 8-10 salaried and hourly employees.

Requirements

What You Bring to the Team by Way of Skills and Experience:

• •Bachelor’s degree in cybersecurity, computer science, information systems, business, or a related field; advanced degree preferred.
• •12+ years of progressive experience in information security, cybersecurity, technology risk, or a related discipline, with at least 5 years of experience leading security teams or enterprise security programs.
• •Demonstrated experience developing and executing an enterprise cybersecurity strategy.
• •Strong background in security governance, risk management, compliance, audit, and enterprise data governance
• •Experience leading incident response and organizational recovery from security events.
• •Experience with cloud security, identity and access management, application security, and security operations.
• •Experience partnering with product and engineering teams to secure customer-facing platforms and reduce abuse, fraud, and operational security risk.
• •Experience communicating cybersecurity risks and recommendations to executive leadership and boards.
• •Strong knowledge of recognized security frameworks and practices, including NIST, ISO 27001, CIS Controls, or equivalent.
• •Excellent written, verbal, analytical, and presentation skills.
• •Ability to translate complex technical issues into clear business and risk considerations.

Preferred Qualifications:

• •Professional certifications such as CISSP, CISM, CRISC, CISA, CCSP, or GIAC credentials.
• •Experience supporting a fast-growing distribu