Director of Security, Risk

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee and enhance SentiLink's security governance, risk, and compliance framework.

• Guide and mentor security and compliance staff while developing organizational strategies and hiring plans.

• Manage security compliance and audit initiatives, including FedRAMP, SOC 2, and PCI DSS.

• Direct external assessments, control effectiveness management, evidence collection, and oversee Vanta and compliance automation.

• Supervise FedRAMP continuous monitoring, POA&M governance, compliance with change-management, agency-specific requirements, and readiness for assessments.

• Create and maintain a robust security risk management program.

• Take charge of identifying, assessing, documenting, escalating, and addressing security risks, control deficiencies, and exceptions.

• Lead third-party security risk management, vendor due diligence, ensure quality assessments, and provide ongoing vendor supervision.

• Conduct customer and partner security assessments and audits.

• Assess contractual security obligations with Legal and coordinate technical responses.

• Manage security policy and control governance, ensuring policies, standards, and control frameworks are up-to-date.

• Establish accountability, measurable outcomes, repeatable processes, and automation.

• Recognize emerging risks and requirements, communicate recommendations to leadership, and drive improvements across organizational boundaries.

• Report to SentiLink's security leader and work collaboratively with Security Engineering, Engineering, IT, Legal, Product, and business teams.

• Develop a proactive, efficient, and scalable security program that significantly mitigates organizational risk.

⛳️ Requirements

• Over 10 years of experience in information security, with considerable experience in leading security governance, compliance, assurance, or risk management initiatives.

• Proven experience managing key security compliance and assurance programs such as FedRAMP, SOC 2, PCI DSS, or similar regulatory frameworks.

• Direct interaction with auditors, assessors, and external stakeholders.

• Strong technical knowledge of modern cloud infrastructure, SaaS application security, identity and access management, vulnerability management, and security architecture.

• Ability to independently assess technical findings, control designs, and remediation strategies.

• Demonstrated skill in building and enhancing security programs, identifying control deficiencies and emerging needs, setting priorities, and translating security risks into actionable plans for the organization.

• Experience in managing and developing security professionals, as well as leading programs across distributed teams.

• Familiarity with third-party risk assessments, customer security diligence, and security risk management.

• Ability to evaluate complex technical and contractual security requirements.

• Excellent written and verbal communication skills, sound judgment, and the ability to influence engineering teams, business leaders, auditors, and external stakeholders.

• This position is remote and based in the United States.

• Must have legal authorization to work in the United States.

🏝️ Benefits

• Employer-sponsored group health insurance for you and your dependents.

• 401(k) plan with employer matching.

• Flexible paid time off.

• Regular company-wide in-person events.

• Home office stipend.

• Equity opportunities.