Director, Security and Compliance

Leads information security and regulatory compliance at Twist Bioscience, reporting to the CIO. The director designs, scales and oversees the global security and compliance programs, defines the company's security posture and runs governance, risk and compliance, linking security engineering, legal obligations and day-to-day business.

On the GRC side, the director sets strategy for and continuously monitors frameworks such as ISO 27001, SOC 2, HIPAA, PCI DSS and NIST CSF, works with Legal on GDPR and CCPA, runs enterprise risk assessments and agrees remediation with department heads, and keeps security policies in step with modern engineering practice such as CI/CD and infrastructure as code. Operationally, the director's security engineering team works with IT Infrastructure on infrastructure monitoring, access control and encryption, the director is a lead member of the incident response team, including regulatory disclosure after a breach, and oversees vendor and supply chain security reviews. The role also manages internal and external audits and reduces overlapping controls, represents Twist's security posture to enterprise customers through questionnaires and calls, reports risk to executives and the board, manages a team of security analysts and compliance staff, and runs security awareness training.

Twist wants at least ten years in security, risk or compliance, five or more in leadership, experience taking SOC 2 Type II or ISO 27001 from nothing to certification, familiarity with AWS and compliance automation tools such as Vanta or Drata, and ideally CISSP, CISM, CISA, CRISC or CIPP. The role is based in South San Francisco.