Director of Security Risk & Trust

<div class="content-intro"><p><em>At Klaviyo, we value the unique backgrounds, experiences and perspectives each Klaviyo (we call ourselves Klaviyos) brings to our workplace each and every day. We believe everyone deserves a fair shot at success and appreciate the experiences each person brings beyond the traditional job requirements. If you’re a close but not exact match with the description, we hope you’ll still consider applying. Want to learn more about life at Klaviyo? Visit <a class="_ymio1r31 _ypr0glyw _zcxs1o36 _mizu194a _1ah3dkaa _ra3xnqa1 _128mdkaa _1cvmnqa1 _4davt94y _4bfu18uv _1hms8stv _ajmmnqa1 _vchhusvi _kqswh2mm _ect4ttxp _syaz13af _1a3b18uv _4fpr8stv _5goinqa1 _f8pj13af _9oik18uv _1bnxglyw _jf4cnqa1 _30l313af _1nrm18uv _c2waglyw _1iohnqa1 _9h8h12zz _10531ra0 _1ien1ra0 _n0fx1ra0 _1vhv17z1" href="http://klaviyo.com/careers" data-renderer-mark="true">klaviyo.com/careers</a>&nbsp;to see how we empower creators to own their own destiny.</em></p></div><h2><strong>About Klaviyo</strong></h2> <p>Klaviyo empowers creators to own their destiny by making first-party data accessible and actionable like never before. We see innovators building incredible businesses every day using Klaviyo's platform, and we're here to make sure they have everything they need to succeed. We're a company that puts customers first, leads with curiosity, and builds with velocity.</p> <p>We're looking for people who are excited about solving hard problems, who thrive in a fast-paced environment, and who want to make a meaningful impact on how businesses grow.</p> <h2><strong>About the Role</strong></h2> <p>We're looking for a <strong>Director of Security Risk and Trust</strong> who breaks the mold of traditional compliance leadership. This isn't a role where you'll spend your days pushing spreadsheets and chasing attestation deadlines—this is a role where you'll <strong>engineer solutions to governance and compliance challenges at scale</strong>, build systems that make security and trust a competitive advantage, and lead a team that operates at the intersection of security engineering, risk management, and regulatory compliance.</p> <p>You'll own the strategy and execution of Klaviyo's Risk and Trust program, partnering deeply with Engineering, Product, Legal, IT, and business teams to embed compliance and risk management into how we build and operate—not bolt it on after the fact. You'll bring a strong technical foundation and an engineering mindset to everything you do, from designing automated compliance pipelines to developing governance frameworks for AI/ML systems. You'll need to be as comfortable reading Terraform configs and reviewing architecture diagrams as you are presenting risk posture to executive leadership.</p> <p>This role reports to the CISO and is a critical member of the Security leadership team.</p> <h2><strong>How You'll Make a Difference</strong></h2> <h3><strong>Build and Own the Risk and Trust Strategy</strong></h3> <ul> <li>Define and execute a forward-looking strategy that scales with Klaviyo's growth, product evolution, and expansion into new markets and regulated industries</li> <li>Develop a risk management program that quantifies and communicates risk in terms the business can act on—not just heat maps, but data-driven models that inform real decisions</li> <li>Own the compliance roadmap across frameworks including ISO 27001, ISO 42001, ISO 27017, ISO 27018, SOC 2 Type II, HIPAA, GDPR, CCPA/CPRA, and emerging AI governance regulations, identifying where frameworks overlap and engineering unified control sets rather than duplicating effort</li> <li>Translate regulatory and compliance requirements into clear, actionable engineering requirements that development teams can implement without ambiguity</li> </ul> <h3><strong>Engineer Solutions, Don't Just Document Them</strong></h3> <ul> <li>Build and maintain <strong>compliance-as-code</strong> infrastructure—automated evidence collection, continuous control monitoring, and policy-as-code implementations that reduce manual toil and increase assurance</li> <li>Design and implement tooling and integrations (leveraging APIs, scripting, and orchestration platforms) that connect GRC workflows with engineering systems (CI/CD pipelines, cloud infrastructure, identity platforms, etc.)</li> <li>Partner with Engineering and Platform teams to embed security and compliance controls directly into the software development lifecycle, infrastructure provisioning, and deployment pipelines without introducing to