Fractional CISO

This is a fully remote position, open to applicants in United States.

📋 Description

• Serve as the accountable security executive overseeing Reflexion’s compliance program related to a significant enterprise agreement.

• Assess and strengthen the ISO 27001/NIST-aligned Statement of Applicability along with the evidence package.

• Sign off on the risk assessment and Statement of Applicability as the designated security officer.

• Act as the security liaison for enterprise vendor-risk teams.

• Engage in 2–3 customer security-diligence calls alongside the CEO.

• Confirm security attestations and controls in collaboration with the CTO.

• Address gaps related to centralized logging, administrative RBAC/audit trails, and secrets management.

• Provide guidance on security exceptions and compensating controls.

• Define a SOC 2 Type I pathway and oversee auditor selection and engagement as necessary.

• Plan and manage the initial external penetration test.

• Take ownership of penetration-test findings triage in conjunction with the CTO.

• Evaluate quarterly compliance-calendar outputs, which include access reviews, risk-assessment updates, training, phishing simulations, BC/DR, and restore tests.

• Assist with annual re-attestation and customer audits.

• Review the breach-notification runbook and provide guidance on incidents that activate 24–72-hour contractual obligations.

• Advise on whether new deal requirements significantly alter Reflexion’s security stance or if they can be negotiated.

⛳️ Requirements

• Previous experience as a CISO, vCISO, or security lead in a firm catering to large enterprises.

• Direct experience managing enterprise vendor-risk reviews from the vendor perspective, including security questionnaires, information-security addenda, and right-to-audit provisions.

• Proficient understanding of ISO 27001 and NIST CSF control mapping.

• Experience in SOC 2 readiness through audit processes.

• Familiarity with practical compensating controls and security exceptions.

• Comfortable taking on the role of the named, responsible individual signing Statements of Applicability and risk assessments, engaging with customers, and endorsing attestations.

• Sufficient technical fluency to validate controls in an AWS and Cloudflare environment, covering IAM, KMS, CloudTrail/logging, and network posture.

• Basic knowledge of HIPAA applicability analysis.

• Understanding of GDPR-related vendor obligations.

• NDA signing is required.

• Availability within the next 60 days.

• Hourly rate must be included in the application.

🏝️ Benefits

• Fully remote work-from-home opportunity.

• Hourly contract or equivalent small monthly commitment.

• Flexible schedule: approximately 15–25 hours in the initial 60 days, followed by 5–10 hours each quarter.

• Direct access to the CEO and CTO.

• No pressure for full-time conversion.

• Existing policies, evidence base, obligations register, DPA/SCC pack, and legal counsel relationships available.

• NDA-required engagement ensures confidentiality regarding a Fortune-Global-500-scale counterparty.