Director of Security

About Divar. Millions of people use Divar to buy, sell, rent, and hire. We run most of the platform ourselves: bare-metal and virtualized infrastructure across several data centers, Kubernetes, Go and Python microservices, Kafka, a range of SQL and NoSQL databases, distributed storage, and our own CI/CD — plus Android, iOS and web clients. That makes securing it our job too.

How security works at Divar. Each infrastructure and product team owns the security of what it builds and runs. A security chapter — engineers who sit inside the infrastructure, backend, mobile and web tribes — sets the bar with them, helps them meet it, and checks the result. Platform teams turn recurring controls into safe defaults. Specialist work, such as incident response retainers, threat hunting, forensics, and red teaming, is done with outside partners, under our direction, and without standing access.

The role. We're looking for a proven engineering leader to make security their full-time job. You lead the security chapter and own Divar's security program end to end: the standard, the roadmap, the risk register, and the results. You report to the CTO, meet the CEO in a quarterly security steering review, and can take a critical risk straight to the founder when it isn't being addressed.

A security background is not required. We care more that you have run serious engineering organizations, understand how systems fail, and can get many teams to deliver on a shared goal. You'll learn security deeply and quickly — and you should want to.

What makes a Director of Security at Divar?

• You've built and run real systems. You've owned production infrastructure or platforms at scale and know where they break: access, secrets, deployments, backups, dependencies.
• You get cross-team programs over the line. You've driven work that many teams had to deliver, without managing all of them, and you know the difference between a plan and a result.
• You measure progress. "We're hardened" isn't an answer. "73% of CIS Level 1 controls pass, and every failure has a documented exception" is.
• You think about risk, not checklists. You choose what matters most, write down what we decide to accept, and come back to it.
• You learn fast and ask the right people. You go deep enough to judge a design yourself, and you know when to rely on the specialists in the chapter and on outside partners.
• You're honest about trade-offs. You can tell leadership what a decision costs in risk, money, and team capacity, and you're willing to say "not now."

Your first year

• Month 1: Get to know the people, products, and stack. Review the security roadmap already underway across the datacenter, production platform, CI/CD, data, and client teams. Walk the security standard, threat scenarios, and controls with the chapter until you can explain each top risk in your own words.
• Months 2–3: Take ownership of the roadmap. Get the security charter approved: company-wide standard, exception process, risk acceptance, and remediation deadlines. Agree each chapter member's priorities with their tribe lead. Put the incident response partner under contract.
• Months 4–12: Security posture is measured and reported every quarter. Asset inventory is complete and visible. Recovery drills run on a schedule. Hardening reaches the remaining data stores. Security is part of every design review and every release gate. By then we'll rely on your judgment to tell us what comes next.

We'll judge your success by how much risk goes down and how much more resilient we become, not by how many policies or tools you introduce.