Manager Corporate Technology (Security & IT)

About the Role

Caribou Corporate Technology

Maybe you came up through security - incident response, GRC, compliance programs - and over time took broader ownership of the tools and systems that make a company capable. Or you came up through IT and digital workplace leadership, and earned your security credentials by stepping into the function when your company needed it. Either path lands you in the same place: someone who can guide a senior security team, run the SaaS and AI tools portfolio, and build the enablement motion that turns licensed software into actual productivity.

On the security side, that means you've been the person who delivered a SOC 2 audit, not just the person in the room. You've tuned a SIEM, led an incident, and written GRC controls that held up under scrutiny. On the IT side, that means you've run a SaaS portfolio, built adoption programs that changed how people work, held real accountability for identity and access, and have the instinct to build an AI enablement program for employees who don't write code. What matters is that you've done both meaningfully, not which one came first.

You will own Caribou’s security and IT programs. Your team includes three senior security practitioners and a senior IT administrator. You set the direction, hold the strategy and vendor relationships, and keep the programs advancing.

We believe CTech works best as a partnership with employees, not a policing function - you'll keep it that way. This role reports directly to the CTO, designed for a leader who wants to evolve the function and grow their career alongside a rapidly scaling company.

Outcomes

Here's what success looks like in the first 12-18 months:

• Caribou's security posture advances year over year - the program has a roadmap, diligence reviews go smoothly, and findings reflect it
• SOC 2 Type II delivers clean with no surprises - systematic evidence collection, not a heroics sprint at audit time
• Detection and response capabilities improve measurably - SIEM, CrowdStrike, Wiz, and DLP are operationally sound and the team can say why
• GRC policy and control documents reflect how Caribou actually operates, not how it operated two years ago
• Licensed tools