iHerb, LLC

Security Engineer

• Lead global information security program with emphasis on Governance, Risk, and Compliance (GRC), Data Governance, and Application/Product Security
• Drive strategy, execution, and oversight of enterprise-wide security initiatives to protect customer trust and sensitive data
• Develop a vision and multi-year strategy for governance and risk management with measurable goals and metrics
• Design, develop, coordinate, and document the secure operation of information systems and enterprise-wide data protection best practices
• Ensure application/product security practices align with industry standards, regulations, and compliance frameworks and maintain necessary certifications
• Oversee implementation of advanced security monitoring and analysis tools to detect and respond to security incidents and vulnerabilities
• Evaluate the security posture of third-party cloud providers and vendors and implement strategies to manage and mitigate associated risks
• Build, mentor, and lead security engineering, product security, cloud security, and GRC teams; foster a collaborative and innovative environment
• Oversee penetration testing, vulnerability management, and remediation processes for applications and APIs
• Partner with engineering teams to embed security into SDLC and CI/CD pipelines and champion DevSecOps practices
• Act as a trusted advisor to executive leadership and the board on emerging security threats and business risks
• Foster a security-first culture across the enterprise through training and awareness programs

Director of Information Security