Cybersecurity Lead – Security Engineering, Compliance Lead

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Oversee the triage and prioritization of security findings from SAST tools, infrastructure security assessments, penetration tests, and newly disclosed CVEs.

• Evaluate risk and severity, set remediation priorities, and designate ownership and deadlines.

• Collaborate with engineering and infrastructure teams to address vulnerabilities through patching, configuration adjustments, dependency upgrades, and resource decommissioning.

• Incorporate security findings into engineering work management systems and monitor owners, tickets, and target remediation dates.

• Communicate remediation progress, ongoing risks, and security trends to IT, engineering, and executive leadership.

• Provide updates on vulnerabilities and remediation efforts to customers.

• Lead security incident responses from detection and investigation to containment, remediation, and post-incident analysis.

• Coordinate urgent responses to vulnerabilities and CVEs across technical teams.

• Establish communication protocols for incidents, including internal status updates, executive briefings, and Customer Experience talking points.

• Prepare customer-facing communications regarding potential exposures, remediation status, and detection efforts.

• Maintain incident response runbooks and on-call escalation procedures.

• Conduct regular tabletop exercises for incident response.

• Manage cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.

• Develop and enforce identity and access management policies.

• Oversee identity controls across Microsoft Entra ID and AWS IAM.

• Perform access reviews for employees, contractors, and third-party vendors.

• Identify and rectify excessive permissions, inactive accounts, and access control gaps.

• Create, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST CSF and ISO 27001.

• Manage technical security controls supporting SOC 2 Type II and ISO 27001 compliance.

• Collaborate with GRC on audit readiness, evidence collection, and remediation of control gaps.

• Monitor regulatory and industry requirements affecting critical-infrastructure customers.

• Translate regulatory and customer requirements into practical technical security controls.

• Lead technical responses to customer security questionnaires.

• Represent Irth's cybersecurity program during customer security reviews and discussions.

• Manage third-party penetration testing engagements and security vendors.

• Assist in cybersecurity due diligence for acquisitions.

• Drive security findings to resolution, establish accountability and measurable remediation timelines, and communicate security issues to both technical and non-technical audiences.

⛳️ Requirements

• 8+ years of experience in cybersecurity engineering or security operations, including a minimum of 3 years in a leadership role within a security program or function, ideally in a SaaS environment.

• Practical cloud security experience across AWS and Microsoft Azure, including Identity and Access Management (IAM), cloud network security controls, security logging, monitoring, and audit trails, AWS CloudTrail, Microsoft Entra sign-in and audit logs, and cloud security posture management tools such as Wiz.

• Proven experience managing vulnerability management comprehensively, including identifying, triaging, prioritizing, assigning, tracking, and driving remediation in collaboration with engineering teams.

• Demonstrated capability in leading security incident responses, including providing clear, timely written communications to executive leadership and customers in high-pressure situations.

• Familiarity with SOC 2 Type II, ISO 27001, and NIST Cybersecurity Framework (CSF), including experience as a key technical control owner during at least one SOC 2 Type II audit.

• Ability to review and interpret application code, infrastructure-as-code (IaC), and configurations for Linux and Windows servers to assess security risks and validate remediation strategies.

• Excellent written and verbal communication skills, solid technical judgment, and the ability to differentiate between issues that require immediate escalation and those that can be resolved through standard remediation processes.

• Experience supporting utilities, pipelines, energy providers, or other critical-infrastructure clients, including knowledge of TSA pipeline security directives or NERC CIP requirements.

• Awareness of Canadian privacy regulations, including Quebec's Law 25.

• Experience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.

• Experience in conducting cybersecurity due diligence or supporting security integration efforts related to mergers and acquisitions.

• Relevant industry certifications, such as Certified Information Systems …

🏝️ Benefits

• Join a vibrant, expanding company with a strong reputation in its industry.

• Competitive salary.

• Comprehensive health plan options, including medical, dental, and vision coverage.

• 401(k) plan with company matching.

• Flexible PTO policy in addition to company-paid holidays.

• Additional benefits, including life insurance, pet insurance, and employee discounts and perks programs.

• Generous one-time work-from-home stipend to assist you in setting up your home workspace.

• Company events and opportunities for connection, including monthly team lunches, volunteer outings, and quarterly gatherings.

• Hybrid employees have access to complimentary snacks, beverages, and coffee at our Columbus, Ohio office.