Lead - Information Security & Compliance

Company Overview

Position Summary

Key Responsibilities

• Own the design, implementation, operation, and continuous improvement of the Information Security Management System (ISMS), ISO 27001 controls, and SOC 2 control environment, including control ownership, evidence, and ongoing readiness.
• Plan and lead internal security audits, ISO 27001 and SOC 2 assessments, surveillance and external audits; coordinate auditors, evidence collection, corrective actions, and timely closure of findings.
• Maintain the security risk register and drive periodic risk assessments, control testing, gap analyses, remediation plans, exception reviews, and leadership reporting across business, product, infrastructure, and vendors.
• Own and maintain security policies, standards, SOPs, registers, and supporting documentation; assign control owners, train relevant teams, monitor adherence, and follow up on deviations so processes work in practice, not just on paper.
• Own the security incident response framework, escalation and communication procedures, incident coordination, root-cause reviews, corrective actions, and periodic readiness exercises with engineering and IT teams.
• Run vendor and third-party security due diligence, periodic reviews, contractual control tracking, and remediation follow-up in coordination with procurement and business owners.
• Own business continuity and disaster recovery governance: coordinate BCP/DR plans, RTO/RPO definitions, tabletop and recovery exercises, backup assurance, documented outcomes, and remediation with technical owners.
• Coordinate vulnerability assessments, penetration testing, security reviews, and remediation tracking with engineering and infrastructure owners; prioritize findings by risk and preserve audit-ready evidence of closure.
• Build and deliver role-appropriate security awareness, phishing readiness, policy communication, onboarding training, and regular reinforcement of secure practices across the organization.

• Supervise the IT operations owner responsible for employee support, hardware, software, and connectivity; define service expectations, review recurring issues, and intervene for security-sensitive escalations.
• Establish and monitor IT SOPs for employee onboarding/offboarding, account provisioning, access approvals, timely deprovisioning, periodic access reviews, and asset recovery; ensure the IT owner executes and records these controls.
• Govern security configuration and access controls for Google Workspace/Microsoft 365, identity and SSO, MFA, endpoint management/MDM, and other core tools; review the IT owner's implementation and exception handling.
• Hold IT accountable for accurate device, software, license, and subscription inventories, endpoint compliance, lifecycle processes, and evidence of control execution.
• Review IT procurement and new-tool onboarding for security, data protection, access, and vendor risk; supervise implementation rather than personally handling routine procurement or device deployment.
• Provide security oversight of AWS/GCP or other cloud environments, including identity and access, configuration baselines, logging, backup, vulnerability exposure, and remediation with engineering or infrastructure teams.

• Serve as the accountable security and compliance point of contact for customers, prospects, auditors, and internal business stakeholders.
• Own timely, accurate responses to customer security questionnaires, due diligence, RFP security sections, security evidence requests, and follow-up clarifications; coordinate verified inputs with technical and business teams.
• Lead customer security reviews and calls, partnering with Sales, Customer Success, Legal, and Engineering to explain controls, address risks, and track any agreed security commitments to closure.
• Own the accuracy and currency of customer-facing security documentation, approved audit reports and certifications, trust materials, and standard assurance responses, sharing sensitive evidence appropriately.

Qualifications & Experience

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field, or equivalent practical experience.
• 4-7 years of relevant experience with a strong primary focus on information security governance, compliance, risk, audits, and security program ownership; IT operations oversight experience is sufficient.
• Demonstrated ownership of ISO 27001 implementation/maintenance and SOC 2 readiness or audit cycles, including ISMS operation, control mapping, evidence collection, internal audits, and corrective-action management.
• Strong practical knowledge of ISMS, security risk assessments, access management, asset controls, incident response, vendor risk, vulnerability management, BCP/DR, and policies/SOP implementation and monitoring.
• Ability to supervise an IT operations professional and govern organizational IT controls, identity and endpoint security, employee access lifecycle, asset management, and escalations without being the primary helpdesk operator.
• Excellent written and verbal communication skills, including independently handling customer security questionnaires, enterprise security reviews, auditor interactions, and clear executive updates.
• Strong security documentation, control-evidence management, audit project management, process discipline, and cross-functional follow-through.
• An ownership-driven leader who can translate security requirements into operational controls, monitor adherence, close gaps, and independently drive multiple audit, customer, and internal security priorities.

• Security qualifications such as CISM, CISSP, ISO 27001 Lead Implementer/Lead Auditor, or comparable hands-on audit and implementation experience.
• Practical understanding of cloud security controls and shared-responsibility models in AWS, Azure, or GCP.
• Familiarity with privacy and data-protection obligations, such as GDPR or CCPA, and enterprise customer contractual security requirements.
• Exposure to security tooling such as SIEM, EDR, vulnerability scanners, GRC/audit evidence platforms, and security monitoring workflows.
• Experience supporting security/compliance programs and customer security reviews in a B2B SaaS or enterprise-facing environment.
• Experience supervising an IT owner or junior team members, coordinating security initiatives across engineering and business teams, and holding control owners accountable.