Associate Director, Cybersecurity, Privacy & IT
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections with real content.
We have content for About the role (the paragraph after "About the Role:").
Responsibilities: "What You'll Do:" with bullet list items (multiple paragraphs). We'll need to convert each bullet into - . The text includes headings like Cybersecurity program, IT and identity, Privacy and data protection, Enterprise integration and governance, AI governance. Those could be subheadings but we only allowed
for sections; we could treat them as ? Not allowed. Probably we keep them as part of list items or as inside li. But we must not invent headings beyond allowed? The instruction: use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but says use for section headings. Could use for subsections? Not specified. Safer to just keep them as part of list items with maybe . We'll output - for each duty.
Requirements: "About You:" bullet list of requirements. Also "Nice to Have:" could be included as part of Requirements or separate but we can include as part of Requirements with maybe a note.
Benefits: "We offer a competitive salary ... Benefits include medical, dental, vision, 401k with Squatch match, and PTO. We also have great perks like healthy snacks, frequent company events, and of course, free products!" So we have benefits.
Pay: "The anticipated base compensation range for this role will be $190,000 to $215,000. Compensation will be commensurate with the candidate's experience and local market rates." We need to include Pay section only if posting actually states them. It does state a range, though also says commensurate with experience. We should include the range. Avoid filler like "commensurate with experience" maybe we can include it as part of Pay section but not as placeholder. The instruction: never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD"). So we cannot have a Pay section that only says "commensurate with experience". But we have actual range. We can include the range and maybe note that compensation will be commensurate with experience (that's filler?). Might be considered filler. Safer to include just the range: $190,000 to $215,000. Possibly also mention it's full-time hybrid.
Schedule: "This is a full-time, hybrid role based in Marina Del Rey, CA." So we have schedule: full-time, hybrid, location. So we can include Schedule section.
We must not include boilerplate like EEO, legal, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to keep details like reporting to Sr. Director, Data & Technology, sits on Technology leadership team, partner with eCommerce, marketing, legal, present to executive team, etc. Those are part of About the role.
We need to keep all bullet points under What You'll Do exactly as given, not summarizing.
We need to keep all bullet points under About You exactly.
We need to keep benefits details.
We need to keep pay range.
We need to keep schedule: full-time, hybrid, Marina Del Rey, CA.
We need to not include Job ID etc.
Now produce HTML fragment.
Structure:
About the role
... (the paragraph after About the Role: up to before What You'll Do? Actually the About the role section includes multiple paragraphs: "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: ... This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology. This is a full-time, hybrid role based in Marina Del Rey, CA." The last sentence about full-time hybrid could be moved to Schedule but it's also part of About the role. We could keep it there but then Schedule would duplicate. Better to keep About the role up to before the schedule sentence, and then schedule separate. However we must preserve all substantive information; we can keep the schedule info in Schedule section and not duplicate. But we need to ensure we don't lose that info. We'll put schedule in its own section.
Thus About the role paragraph: from "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: our security program, our privacy compliance program, and the internal technology our employees use every day. You'll own the strategy, and the team for all three. As part of Unilever, we now operate against a global control framework, and a meaningful share of this role is integration work: mapping our controls to enterprise standards, participating in assessment and reporting cycles, aligning identity, endpoint, and third-party risk practices, and translating between a global program and a business that still runs at startup speed. Doing that well, protecting the company without slowing it down, is the core challenge of the job. This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology."
Then Responsibilities:
Responsibilities
then - each duty.
We need to parse the "What You'll Do:" section.
It has headings:
Cybersecurity program
- Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
- Own the multi-year security roadmap.
- Evaluate, select, implement, and operate security tooling across endpoint, email, identity, cloud, and application layers.
- Monitor and triage vulnerabilities and emerging threats; drive remediation to completion with the teams that own the systems.
- Manage our MDR and incident response partners, and own the incident response plan, including tabletop exercises and post-incident reviews.
- Run security awareness training and phishing simulation for employees and contractors.
IT and identity
- Lead the IT function and manage the IT Manager by setting priorities and service expectations, and actively developing them toward broader ownership of IT operations over time.
- Own identity and access management end to end via SSO, MFA, provisioning and deprovisioning, and periodic access reviews across our SaaS estate.
- Own endpoint management and device lifecycle, from procurement through secure decommissioning.
- Set the standard for IT support responsiveness and make sure onboarding and offboarding are fast, complete, and auditable.
- Own SaaS governance: what tools we use, who approves them, how they're reviewed for security, and what happens to the data in them.
Privacy and data protection
- Own our privacy compliance program across CCPA/CPRA, other US state privacy laws, and UK and EU GDPR.
- Run consumer rights request intake and fulfillment with Customer Support, and keep the process defensible as volume grows.
- Maintain data mapping, records of processing, retention schedules, and privacy notices; partner with Legal and outside counsel on assessments and filings.
- Advise Marketing and eComm on consent management, cookies, pixels, and data sharing with ad and analytics partners.
- Own third-party and vendor risk review, including DPAs and security assessments for new tools.
Enterprise integration and governance
- Serve as our point of contact for Unilever security, privacy, and IT governance workstreams.
- Map our controls to enterprise standards, close identified gaps, and manage the reporting and assessment cadence.
- Lead our part of systems and identity integration projects, negotiating sequencing and exceptions where a global standard doesn't fit a DTC business.
- Prepare Dr. Squatch for audits and control testing, and own the evidence.
AI governance
- Own acceptable use, data handling, and review standards for AI tools across the company.
- Assess AI vendors for security and privacy risk before adoption, and keep an inventory of what's in use and what data it touches.
- Partner with the Data team so governance enables adoption rather than blocking it.
We need to turn each bullet into
- . The headings could be kept as inside li or as separate
but we must not create extra headings. We'll embed them as maybe.
Thus each - will contain the heading in bold then the description.
E.g.
- Cybersecurity program: Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
But note that the heading is separate line; we can combine.
We'll produce list items accordingly.
Now Requirements: Requirements
then - each bullet from About You.
About You bullet list:
- 8–12 years across cybersecurity, IT, and/or privacy, including end-to-end ownership of a security program rather than a single function within one.
- Demonstrated experience applying a security and risk framework, such as NIST CSF, CIS Controls, ISO 27001, or SOC 2, in a real environment, not just on paper.
- Hands-on depth in a cloud-first, SaaS-first stack: identity (Okta or equivalent), endpoint management, email security, logging and detection.
- Working knowledge of CCPA/CPRA and GDPR, and experience operationalizing them, not only interpreting them.
- Direct people management experience, including developing a more junior manager or engineer into greater scope. You'll inherit a capable IT Manager whose growth is part of your job.
- Judgment about where to spend limited resources, and the communication skills to explain that tradeoff to executives in business terms, and to hold the line when the answer is no.
- Comfort taking a vague problem and turning it into a specific, sequenced plan.
- You get things done without perfect resources, and you act with urgency.
- You play to win. You hold high standards, take ownership, and stay invested in the outcome.
- Team first. You're humble, you help outside your own wheelhouse, and you're good to work with when something is on fire.
- You can hold a security line and stay a partner to the business at the same time.
Then "Nice to Have:" list:
- Experience at a company operating inside a larger parent organization, or through an acquisition integration.
- Ecommerce or DTC background, and familiarity with Shopify, ad platform data flows, and consumer data at scale.
- CISSP, CISM, CIPP/US, or CIPP/E.
We could include Nice to Have as part of Requirements or separate section? The instruction only lists certain headings; we could include them under Requirements as part of same list, maybe with a note "Nice to have". But we could also create a separate section "Qualifications" or "Skills". However we have Qualifications and Skills as possible headings. We could put Nice to Have under Skills. But better to keep Requirements as mandatory, and Nice to
for sections; we could treat them as ? Not allowed. Probably we keep them as part of list items or as inside li. But we must not invent headings beyond allowed? The instruction: use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but says use for section headings. Could use for subsections? Not specified. Safer to just keep them as part of list items with maybe . We'll output - for each duty.
Requirements: "About You:" bullet list of requirements. Also "Nice to Have:" could be included as part of Requirements or separate but we can include as part of Requirements with maybe a note.
Benefits: "We offer a competitive salary ... Benefits include medical, dental, vision, 401k with Squatch match, and PTO. We also have great perks like healthy snacks, frequent company events, and of course, free products!" So we have benefits.
Pay: "The anticipated base compensation range for this role will be $190,000 to $215,000. Compensation will be commensurate with the candidate's experience and local market rates." We need to include Pay section only if posting actually states them. It does state a range, though also says commensurate with experience. We should include the range. Avoid filler like "commensurate with experience" maybe we can include it as part of Pay section but not as placeholder. The instruction: never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD"). So we cannot have a Pay section that only says "commensurate with experience". But we have actual range. We can include the range and maybe note that compensation will be commensurate with experience (that's filler?). Might be considered filler. Safer to include just the range: $190,000 to $215,000. Possibly also mention it's full-time hybrid.
Schedule: "This is a full-time, hybrid role based in Marina Del Rey, CA." So we have schedule: full-time, hybrid, location. So we can include Schedule section.
We must not include boilerplate like EEO, legal, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to keep details like reporting to Sr. Director, Data & Technology, sits on Technology leadership team, partner with eCommerce, marketing, legal, present to executive team, etc. Those are part of About the role.
We need to keep all bullet points under What You'll Do exactly as given, not summarizing.
We need to keep all bullet points under About You exactly.
We need to keep benefits details.
We need to keep pay range.
We need to keep schedule: full-time, hybrid, Marina Del Rey, CA.
We need to not include Job ID etc.
Now produce HTML fragment.
Structure:
About the role
... (the paragraph after About the Role: up to before What You'll Do? Actually the About the role section includes multiple paragraphs: "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: ... This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology. This is a full-time, hybrid role based in Marina Del Rey, CA." The last sentence about full-time hybrid could be moved to Schedule but it's also part of About the role. We could keep it there but then Schedule would duplicate. Better to keep About the role up to before the schedule sentence, and then schedule separate. However we must preserve all substantive information; we can keep the schedule info in Schedule section and not duplicate. But we need to ensure we don't lose that info. We'll put schedule in its own section.
Thus About the role paragraph: from "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: our security program, our privacy compliance program, and the internal technology our employees use every day. You'll own the strategy, and the team for all three. As part of Unilever, we now operate against a global control framework, and a meaningful share of this role is integration work: mapping our controls to enterprise standards, participating in assessment and reporting cycles, aligning identity, endpoint, and third-party risk practices, and translating between a global program and a business that still runs at startup speed. Doing that well, protecting the company without slowing it down, is the core challenge of the job. This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology."
Then Responsibilities:
Responsibilities
then - each duty.
We need to parse the "What You'll Do:" section.
It has headings:
Cybersecurity program
- Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
- Own the multi-year security roadmap.
- Evaluate, select, implement, and operate security tooling across endpoint, email, identity, cloud, and application layers.
- Monitor and triage vulnerabilities and emerging threats; drive remediation to completion with the teams that own the systems.
- Manage our MDR and incident response partners, and own the incident response plan, including tabletop exercises and post-incident reviews.
- Run security awareness training and phishing simulation for employees and contractors.
IT and identity
- Lead the IT function and manage the IT Manager by setting priorities and service expectations, and actively developing them toward broader ownership of IT operations over time.
- Own identity and access management end to end via SSO, MFA, provisioning and deprovisioning, and periodic access reviews across our SaaS estate.
- Own endpoint management and device lifecycle, from procurement through secure decommissioning.
- Set the standard for IT support responsiveness and make sure onboarding and offboarding are fast, complete, and auditable.
- Own SaaS governance: what tools we use, who approves them, how they're reviewed for security, and what happens to the data in them.
Privacy and data protection
- Own our privacy compliance program across CCPA/CPRA, other US state privacy laws, and UK and EU GDPR.
- Run consumer rights request intake and fulfillment with Customer Support, and keep the process defensible as volume grows.
- Maintain data mapping, records of processing, retention schedules, and privacy notices; partner with Legal and outside counsel on assessments and filings.
- Advise Marketing and eComm on consent management, cookies, pixels, and data sharing with ad and analytics partners.
- Own third-party and vendor risk review, including DPAs and security assessments for new tools.
Enterprise integration and governance
- Serve as our point of contact for Unilever security, privacy, and IT governance workstreams.
- Map our controls to enterprise standards, close identified gaps, and manage the reporting and assessment cadence.
- Lead our part of systems and identity integration projects, negotiating sequencing and exceptions where a global standard doesn't fit a DTC business.
- Prepare Dr. Squatch for audits and control testing, and own the evidence.
AI governance
- Own acceptable use, data handling, and review standards for AI tools across the company.
- Assess AI vendors for security and privacy risk before adoption, and keep an inventory of what's in use and what data it touches.
- Partner with the Data team so governance enables adoption rather than blocking it.
We need to turn each bullet into
- . The headings could be kept as inside li or as separate
but we must not create extra headings. We'll embed them as maybe.
Thus each - will contain the heading in bold then the description.
E.g.
- Cybersecurity program: Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
But note that the heading is separate line; we can combine.
We'll produce list items accordingly.
Now Requirements: Requirements
then - each bullet from About You.
About You bullet list:
- 8–12 years across cybersecurity, IT, and/or privacy, including end-to-end ownership of a security program rather than a single function within one.
- Demonstrated experience applying a security and risk framework, such as NIST CSF, CIS Controls, ISO 27001, or SOC 2, in a real environment, not just on paper.
- Hands-on depth in a cloud-first, SaaS-first stack: identity (Okta or equivalent), endpoint management, email security, logging and detection.
- Working knowledge of CCPA/CPRA and GDPR, and experience operationalizing them, not only interpreting them.
- Direct people management experience, including developing a more junior manager or engineer into greater scope. You'll inherit a capable IT Manager whose growth is part of your job.
- Judgment about where to spend limited resources, and the communication skills to explain that tradeoff to executives in business terms, and to hold the line when the answer is no.
- Comfort taking a vague problem and turning it into a specific, sequenced plan.
- You get things done without perfect resources, and you act with urgency.
- You play to win. You hold high standards, take ownership, and stay invested in the outcome.
- Team first. You're humble, you help outside your own wheelhouse, and you're good to work with when something is on fire.
- You can hold a security line and stay a partner to the business at the same time.
Then "Nice to Have:" list:
- Experience at a company operating inside a larger parent organization, or through an acquisition integration.
- Ecommerce or DTC background, and familiarity with Shopify, ad platform data flows, and consumer data at scale.
- CISSP, CISM, CIPP/US, or CIPP/E.
We could include Nice to Have as part of Requirements or separate section? The instruction only lists certain headings; we could include them under Requirements as part of same list, maybe with a note "Nice to have". But we could also create a separate section "Qualifications" or "Skills". However we have Qualifications and Skills as possible headings. We could put Nice to Have under Skills. But better to keep Requirements as mandatory, and Nice to
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It doesn't forbid other headings, but says use for section headings. Could use for subsections? Not specified. Safer to just keep them as part of list items with maybe . We'll output - for each duty.
Requirements: "About You:" bullet list of requirements. Also "Nice to Have:" could be included as part of Requirements or separate but we can include as part of Requirements with maybe a note.
Benefits: "We offer a competitive salary ... Benefits include medical, dental, vision, 401k with Squatch match, and PTO. We also have great perks like healthy snacks, frequent company events, and of course, free products!" So we have benefits.
Pay: "The anticipated base compensation range for this role will be $190,000 to $215,000. Compensation will be commensurate with the candidate's experience and local market rates." We need to include Pay section only if posting actually states them. It does state a range, though also says commensurate with experience. We should include the range. Avoid filler like "commensurate with experience" maybe we can include it as part of Pay section but not as placeholder. The instruction: never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD"). So we cannot have a Pay section that only says "commensurate with experience". But we have actual range. We can include the range and maybe note that compensation will be commensurate with experience (that's filler?). Might be considered filler. Safer to include just the range: $190,000 to $215,000. Possibly also mention it's full-time hybrid.
Schedule: "This is a full-time, hybrid role based in Marina Del Rey, CA." So we have schedule: full-time, hybrid, location. So we can include Schedule section.
We must not include boilerplate like EEO, legal, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to keep details like reporting to Sr. Director, Data & Technology, sits on Technology leadership team, partner with eCommerce, marketing, legal, present to executive team, etc. Those are part of About the role.
We need to keep all bullet points under What You'll Do exactly as given, not summarizing.
We need to keep all bullet points under About You exactly.
We need to keep benefits details.
We need to keep pay range.
We need to keep schedule: full-time, hybrid, Marina Del Rey, CA.
We need to not include Job ID etc.
Now produce HTML fragment.
Structure:
About the role
... (the paragraph after About the Role: up to before What You'll Do? Actually the About the role section includes multiple paragraphs: "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: ... This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology. This is a full-time, hybrid role based in Marina Del Rey, CA." The last sentence about full-time hybrid could be moved to Schedule but it's also part of About the role. We could keep it there but then Schedule would duplicate. Better to keep About the role up to before the schedule sentence, and then schedule separate. However we must preserve all substantive information; we can keep the schedule info in Schedule section and not duplicate. But we need to ensure we don't lose that info. We'll put schedule in its own section.
Thus About the role paragraph: from "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: our security program, our privacy compliance program, and the internal technology our employees use every day. You'll own the strategy, and the team for all three. As part of Unilever, we now operate against a global control framework, and a meaningful share of this role is integration work: mapping our controls to enterprise standards, participating in assessment and reporting cycles, aligning identity, endpoint, and third-party risk practices, and translating between a global program and a business that still runs at startup speed. Doing that well, protecting the company without slowing it down, is the core challenge of the job. This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology."
Then Responsibilities:
Responsibilities
then - each duty.
We need to parse the "What You'll Do:" section.
It has headings:
Cybersecurity program
- Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
- Own the multi-year security roadmap.
- Evaluate, select, implement, and operate security tooling across endpoint, email, identity, cloud, and application layers.
- Monitor and triage vulnerabilities and emerging threats; drive remediation to completion with the teams that own the systems.
- Manage our MDR and incident response partners, and own the incident response plan, including tabletop exercises and post-incident reviews.
- Run security awareness training and phishing simulation for employees and contractors.
IT and identity
- Lead the IT function and manage the IT Manager by setting priorities and service expectations, and actively developing them toward broader ownership of IT operations over time.
- Own identity and access management end to end via SSO, MFA, provisioning and deprovisioning, and periodic access reviews across our SaaS estate.
- Own endpoint management and device lifecycle, from procurement through secure decommissioning.
- Set the standard for IT support responsiveness and make sure onboarding and offboarding are fast, complete, and auditable.
- Own SaaS governance: what tools we use, who approves them, how they're reviewed for security, and what happens to the data in them.
Privacy and data protection
- Own our privacy compliance program across CCPA/CPRA, other US state privacy laws, and UK and EU GDPR.
- Run consumer rights request intake and fulfillment with Customer Support, and keep the process defensible as volume grows.
- Maintain data mapping, records of processing, retention schedules, and privacy notices; partner with Legal and outside counsel on assessments and filings.
- Advise Marketing and eComm on consent management, cookies, pixels, and data sharing with ad and analytics partners.
- Own third-party and vendor risk review, including DPAs and security assessments for new tools.
Enterprise integration and governance
- Serve as our point of contact for Unilever security, privacy, and IT governance workstreams.
- Map our controls to enterprise standards, close identified gaps, and manage the reporting and assessment cadence.
- Lead our part of systems and identity integration projects, negotiating sequencing and exceptions where a global standard doesn't fit a DTC business.
- Prepare Dr. Squatch for audits and control testing, and own the evidence.
AI governance
- Own acceptable use, data handling, and review standards for AI tools across the company.
- Assess AI vendors for security and privacy risk before adoption, and keep an inventory of what's in use and what data it touches.
- Partner with the Data team so governance enables adoption rather than blocking it.
We need to turn each bullet into
- . The headings could be kept as inside li or as separate
but we must not create extra headings. We'll embed them as maybe.
Thus each - will contain the heading in bold then the description.
E.g.
- Cybersecurity program: Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
But note that the heading is separate line; we can combine.
We'll produce list items accordingly.
Now Requirements: Requirements
then - each bullet from About You.
About You bullet list:
- 8–12 years across cybersecurity, IT, and/or privacy, including end-to-end ownership of a security program rather than a single function within one.
- Demonstrated experience applying a security and risk framework, such as NIST CSF, CIS Controls, ISO 27001, or SOC 2, in a real environment, not just on paper.
- Hands-on depth in a cloud-first, SaaS-first stack: identity (Okta or equivalent), endpoint management, email security, logging and detection.
- Working knowledge of CCPA/CPRA and GDPR, and experience operationalizing them, not only interpreting them.
- Direct people management experience, including developing a more junior manager or engineer into greater scope. You'll inherit a capable IT Manager whose growth is part of your job.
- Judgment about where to spend limited resources, and the communication skills to explain that tradeoff to executives in business terms, and to hold the line when the answer is no.
- Comfort taking a vague problem and turning it into a specific, sequenced plan.
- You get things done without perfect resources, and you act with urgency.
- You play to win. You hold high standards, take ownership, and stay invested in the outcome.
- Team first. You're humble, you help outside your own wheelhouse, and you're good to work with when something is on fire.
- You can hold a security line and stay a partner to the business at the same time.
Then "Nice to Have:" list:
- Experience at a company operating inside a larger parent organization, or through an acquisition integration.
- Ecommerce or DTC background, and familiarity with Shopify, ad platform data flows, and consumer data at scale.
- CISSP, CISM, CIPP/US, or CIPP/E.
We could include Nice to Have as part of Requirements or separate section? The instruction only lists certain headings; we could include them under Requirements as part of same list, maybe with a note "Nice to have". But we could also create a separate section "Qualifications" or "Skills". However we have Qualifications and Skills as possible headings. We could put Nice to Have under Skills. But better to keep Requirements as mandatory, and Nice to
for subsections? Not specified. Safer to just keep them as part of list items with maybe . We'll output - for each duty.
Requirements: "About You:" bullet list of requirements. Also "Nice to Have:" could be included as part of Requirements or separate but we can include as part of Requirements with maybe a note.
Benefits: "We offer a competitive salary ... Benefits include medical, dental, vision, 401k with Squatch match, and PTO. We also have great perks like healthy snacks, frequent company events, and of course, free products!" So we have benefits.
Pay: "The anticipated base compensation range for this role will be $190,000 to $215,000. Compensation will be commensurate with the candidate's experience and local market rates." We need to include Pay section only if posting actually states them. It does state a range, though also says commensurate with experience. We should include the range. Avoid filler like "commensurate with experience" maybe we can include it as part of Pay section but not as placeholder. The instruction: never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD"). So we cannot have a Pay section that only says "commensurate with experience". But we have actual range. We can include the range and maybe note that compensation will be commensurate with experience (that's filler?). Might be considered filler. Safer to include just the range: $190,000 to $215,000. Possibly also mention it's full-time hybrid.
Schedule: "This is a full-time, hybrid role based in Marina Del Rey, CA." So we have schedule: full-time, hybrid, location. So we can include Schedule section.
We must not include boilerplate like EEO, legal, etc. Remove all that.
We must preserve all substantive information; do not invent or summarize away detail. So we need to keep details like reporting to Sr. Director, Data & Technology, sits on Technology leadership team, partner with eCommerce, marketing, legal, present to executive team, etc. Those are part of About the role.
We need to keep all bullet points under What You'll Do exactly as given, not summarizing.
We need to keep all bullet points under About You exactly.
We need to keep benefits details.
We need to keep pay range.
We need to keep schedule: full-time, hybrid, Marina Del Rey, CA.
We need to not include Job ID etc.
Now produce HTML fragment.
Structure:
About the role
... (the paragraph after About the Role: up to before What You'll Do? Actually the About the role section includes multiple paragraphs: "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: ... This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology. This is a full-time, hybrid role based in Marina Del Rey, CA." The last sentence about full-time hybrid could be moved to Schedule but it's also part of About the role. We could keep it there but then Schedule would duplicate. Better to keep About the role up to before the schedule sentence, and then schedule separate. However we must preserve all substantive information; we can keep the schedule info in Schedule section and not duplicate. But we need to ensure we don't lose that info. We'll put schedule in its own section.
Thus About the role paragraph: from "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: our security program, our privacy compliance program, and the internal technology our employees use every day. You'll own the strategy, and the team for all three. As part of Unilever, we now operate against a global control framework, and a meaningful share of this role is integration work: mapping our controls to enterprise standards, participating in assessment and reporting cycles, aligning identity, endpoint, and third-party risk practices, and translating between a global program and a business that still runs at startup speed. Doing that well, protecting the company without slowing it down, is the core challenge of the job. This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology."
Then Responsibilities:
Responsibilities
then - each duty.
We need to parse the "What You'll Do:" section.
It has headings:
Cybersecurity program
- Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
- Own the multi-year security roadmap.
- Evaluate, select, implement, and operate security tooling across endpoint, email, identity, cloud, and application layers.
- Monitor and triage vulnerabilities and emerging threats; drive remediation to completion with the teams that own the systems.
- Manage our MDR and incident response partners, and own the incident response plan, including tabletop exercises and post-incident reviews.
- Run security awareness training and phishing simulation for employees and contractors.
IT and identity
- Lead the IT function and manage the IT Manager by setting priorities and service expectations, and actively developing them toward broader ownership of IT operations over time.
- Own identity and access management end to end via SSO, MFA, provisioning and deprovisioning, and periodic access reviews across our SaaS estate.
- Own endpoint management and device lifecycle, from procurement through secure decommissioning.
- Set the standard for IT support responsiveness and make sure onboarding and offboarding are fast, complete, and auditable.
- Own SaaS governance: what tools we use, who approves them, how they're reviewed for security, and what happens to the data in them.
Privacy and data protection
- Own our privacy compliance program across CCPA/CPRA, other US state privacy laws, and UK and EU GDPR.
- Run consumer rights request intake and fulfillment with Customer Support, and keep the process defensible as volume grows.
- Maintain data mapping, records of processing, retention schedules, and privacy notices; partner with Legal and outside counsel on assessments and filings.
- Advise Marketing and eComm on consent management, cookies, pixels, and data sharing with ad and analytics partners.
- Own third-party and vendor risk review, including DPAs and security assessments for new tools.
Enterprise integration and governance
- Serve as our point of contact for Unilever security, privacy, and IT governance workstreams.
- Map our controls to enterprise standards, close identified gaps, and manage the reporting and assessment cadence.
- Lead our part of systems and identity integration projects, negotiating sequencing and exceptions where a global standard doesn't fit a DTC business.
- Prepare Dr. Squatch for audits and control testing, and own the evidence.
AI governance
- Own acceptable use, data handling, and review standards for AI tools across the company.
- Assess AI vendors for security and privacy risk before adoption, and keep an inventory of what's in use and what data it touches.
- Partner with the Data team so governance enables adoption rather than blocking it.
We need to turn each bullet into
- . The headings could be kept as inside li or as separate
but we must not create extra headings. We'll embed them as maybe.
Thus each - will contain the heading in bold then the description.
E.g.
- Cybersecurity program: Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
But note that the heading is separate line; we can combine.
We'll produce list items accordingly.
Now Requirements: Requirements
then - each bullet from About You.
About You bullet list:
- 8–12 years across cybersecurity, IT, and/or privacy, including end-to-end ownership of a security program rather than a single function within one.
- Demonstrated experience applying a security and risk framework, such as NIST CSF, CIS Controls, ISO 27001, or SOC 2, in a real environment, not just on paper.
- Hands-on depth in a cloud-first, SaaS-first stack: identity (Okta or equivalent), endpoint management, email security, logging and detection.
- Working knowledge of CCPA/CPRA and GDPR, and experience operationalizing them, not only interpreting them.
- Direct people management experience, including developing a more junior manager or engineer into greater scope. You'll inherit a capable IT Manager whose growth is part of your job.
- Judgment about where to spend limited resources, and the communication skills to explain that tradeoff to executives in business terms, and to hold the line when the answer is no.
- Comfort taking a vague problem and turning it into a specific, sequenced plan.
- You get things done without perfect resources, and you act with urgency.
- You play to win. You hold high standards, take ownership, and stay invested in the outcome.
- Team first. You're humble, you help outside your own wheelhouse, and you're good to work with when something is on fire.
- You can hold a security line and stay a partner to the business at the same time.
Then "Nice to Have:" list:
- Experience at a company operating inside a larger parent organization, or through an acquisition integration.
- Ecommerce or DTC background, and familiarity with Shopify, ad platform data flows, and consumer data at scale.
- CISSP, CISM, CIPP/US, or CIPP/E.
We could include Nice to Have as part of Requirements or separate section? The instruction only lists certain headings; we could include them under Requirements as part of same list, maybe with a note "Nice to have". But we could also create a separate section "Qualifications" or "Skills". However we have Qualifications and Skills as possible headings. We could put Nice to Have under Skills. But better to keep Requirements as mandatory, and Nice to
About the role
... (the paragraph after About the Role: up to before What You'll Do? Actually the About the role section includes multiple paragraphs: "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: ... This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology. This is a full-time, hybrid role based in Marina Del Rey, CA." The last sentence about full-time hybrid could be moved to Schedule but it's also part of About the role. We could keep it there but then Schedule would duplicate. Better to keep About the role up to before the schedule sentence, and then schedule separate. However we must preserve all substantive information; we can keep the schedule info in Schedule section and not duplicate. But we need to ensure we don't lose that info. We'll put schedule in its own section. Thus About the role paragraph: from "Dr. Squatch is looking for an Associate Director of Cybersecurity, Privacy & IT to lead three connected functions: our security program, our privacy compliance program, and the internal technology our employees use every day. You'll own the strategy, and the team for all three. As part of Unilever, we now operate against a global control framework, and a meaningful share of this role is integration work: mapping our controls to enterprise standards, participating in assessment and reporting cycles, aligning identity, endpoint, and third-party risk practices, and translating between a global program and a business that still runs at startup speed. Doing that well, protecting the company without slowing it down, is the core challenge of the job. This role will also continue to drive the security strategy and represent Dr. Squatch in enterprise-level security and privacy governance. You'll sit on the Technology leadership team alongside data engineering, analytics, and business systems, partner closely with eCommerce, marketing, and legal, and present directly to our executive team on risk, incidents, and investment decisions. This role reports to the Sr. Director, Data & Technology." Then Responsibilities:
Responsibilities
then- each duty. We need to parse the "What You'll Do:" section. It has headings: Cybersecurity program - Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first. - Own the multi-year security roadmap. - Evaluate, select, implement, and operate security tooling across endpoint, email, identity, cloud, and application layers. - Monitor and triage vulnerabilities and emerging threats; drive remediation to completion with the teams that own the systems. - Manage our MDR and incident response partners, and own the incident response plan, including tabletop exercises and post-incident reviews. - Run security awareness training and phishing simulation for employees and contractors. IT and identity - Lead the IT function and manage the IT Manager by setting priorities and service expectations, and actively developing them toward broader ownership of IT operations over time. - Own identity and access management end to end via SSO, MFA, provisioning and deprovisioning, and periodic access reviews across our SaaS estate. - Own endpoint management and device lifecycle, from procurement through secure decommissioning. - Set the standard for IT support responsiveness and make sure onboarding and offboarding are fast, complete, and auditable. - Own SaaS governance: what tools we use, who approves them, how they're reviewed for security, and what happens to the data in them. Privacy and data protection - Own our privacy compliance program across CCPA/CPRA, other US state privacy laws, and UK and EU GDPR. - Run consumer rights request intake and fulfillment with Customer Support, and keep the process defensible as volume grows. - Maintain data mapping, records of processing, retention schedules, and privacy notices; partner with Legal and outside counsel on assessments and filings. - Advise Marketing and eComm on consent management, cookies, pixels, and data sharing with ad and analytics partners. - Own third-party and vendor risk review, including DPAs and security assessments for new tools. Enterprise integration and governance - Serve as our point of contact for Unilever security, privacy, and IT governance workstreams. - Map our controls to enterprise standards, close identified gaps, and manage the reporting and assessment cadence. - Lead our part of systems and identity integration projects, negotiating sequencing and exceptions where a global standard doesn't fit a DTC business. - Prepare Dr. Squatch for audits and control testing, and own the evidence. AI governance - Own acceptable use, data handling, and review standards for AI tools across the company. - Assess AI vendors for security and privacy risk before adoption, and keep an inventory of what's in use and what data it touches. - Partner with the Data team so governance enables adoption rather than blocking it. We need to turn each bullet into
- . The headings could be kept as inside li or as separate
but we must not create extra headings. We'll embed them as maybe. Thus each
- will contain the heading in bold then the description. E.g.
- Cybersecurity program: Maintain the cybersecurity risk register: identify risks to our data and systems, assess likelihood and impact, and prioritize what gets addressed first.
But note that the heading is separate line; we can combine. We'll produce list items accordingly. Now Requirements:Requirements
then- each bullet from About You. About You bullet list: - 8–12 years across cybersecurity, IT, and/or privacy, including end-to-end ownership of a security program rather than a single function within one. - Demonstrated experience applying a security and risk framework, such as NIST CSF, CIS Controls, ISO 27001, or SOC 2, in a real environment, not just on paper. - Hands-on depth in a cloud-first, SaaS-first stack: identity (Okta or equivalent), endpoint management, email security, logging and detection. - Working knowledge of CCPA/CPRA and GDPR, and experience operationalizing them, not only interpreting them. - Direct people management experience, including developing a more junior manager or engineer into greater scope. You'll inherit a capable IT Manager whose growth is part of your job. - Judgment about where to spend limited resources, and the communication skills to explain that tradeoff to executives in business terms, and to hold the line when the answer is no. - Comfort taking a vague problem and turning it into a specific, sequenced plan. - You get things done without perfect resources, and you act with urgency. - You play to win. You hold high standards, take ownership, and stay invested in the outcome. - Team first. You're humble, you help outside your own wheelhouse, and you're good to work with when something is on fire. - You can hold a security line and stay a partner to the business at the same time. Then "Nice to Have:" list: - Experience at a company operating inside a larger parent organization, or through an acquisition integration. - Ecommerce or DTC background, and familiarity with Shopify, ad platform data flows, and consumer data at scale. - CISSP, CISM, CIPP/US, or CIPP/E. We could include Nice to Have as part of Requirements or separate section? The instruction only lists certain headings; we could include them under Requirements as part of same list, maybe with a note "Nice to have". But we could also create a separate section "Qualifications" or "Skills". However we have Qualifications and Skills as possible headings. We could put Nice to Have under Skills. But better to keep Requirements as mandatory, and Nice to