Chief Information Security Officer

📋 Description

• • Shape the future of secure, smartphone-first access control. As ButterflyMX’s first Chief Information Security Officer you will own the end-to-end security vision for a platform that already protects more than 20,000 multifamily, commercial, and student-housing properties worldwide. Your strategy will safeguard millions of daily door openings, visitor passes, and device interactions across cloud, mobile, and IoT environments.
• • Build and scale a world-class security organization. You will inherit a small but high-performing security team and grow it into a multi-disciplinary function covering cloud security, application security, IoT/device security, GRC, and security operations. You will define hiring plans, craft career paths, and mentor engineers and analysts who are eager to learn from a seasoned leader.
• • Balance rigorous protection with rapid innovation. ButterflyMX ships features weekly and deploys to production multiple times a day. You will design lightweight controls, secure-by-design patterns, and automated guardrails that let product and engineering teams move fast without compromising customer trust.
• • Own the security roadmap and budget. You will translate business objectives and regulatory obligations into a prioritized, multi-year roadmap. You will manage a security budget that balances tooling, training, and headcount, and you will present ROI-driven metrics to the executive team and board.
• • Lead security operations and incident response. You will stand up a 24×7-capable detection and response capability, run tabletop exercises, and coordinate red-team and purple-team engagements. When incidents occur, you will command the response, communicate transparently with customers, and drive post-mortems that turn lessons learned into durable fixes.
• • Drive compliance beyond checkbox mode. You will own SOC 2 Type II, GDPR, CPRA, and any future frameworks. You will automate evidence collection, map controls to product features, and ensure that audits become a routine by-product of doing things right—not a fire-drill every year.
• • Embed security into the SDLC and CI/CD pipelines. You will partner with Engineering to integrate static and dynamic scanning, container image hardening, IaC scanning, and secure secrets management. You will champion threat modeling for every new feature and ensure that security gates increase velocity rather than slow it down.
• • Secure connected devices at global scale. Our smart intercoms and access controllers run custom firmware and communicate over encrypted channels. You will define secure boot, OTA update, and device identity strategies, and you will work with hardware and firmware teams to ensure that security patches reach tens of thousands of devices seamlessly.
• • Evangelize security across the company. You will create a security champions program, deliver engaging security awareness training, and publish internal “security spotlights” that celebrate teams who ship secure code. You will make security feel like a shared superpower, not an obstacle.
• • Be the public face of security to customers and partners. You will join sales calls, respond to RFP security questionnaires, and present at customer advisory boards. Your calm, clear explanations will turn security from a procurement hurdle into a competitive differentiator.
• • Report directly to the CTO and collaborate with the entire executive team. You will translate technical risk into business risk, advise on M&A security due diligence, and ensure that security strategy aligns with revenue, growth, and customer-experience goals.
• • Foster an inclusive, remote-first security culture. ButterflyMX is a distributed company; you will master asynchronous communication, run inclusive meetings across time zones, and ensure that security policies are equitable and accessible to every employee, contractor, and partner.