Head of Security and Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Take full ownership of the SOC 2 Type II audit cycle, overseeing control design and operation, evidence gathering, auditor relations, remediation, and annual renewal.

• Manage the GRC platform as the official record for controls, policies, and evidence, ensuring it remains audit-ready throughout the year.

• Sustain and enhance compliance posture in accordance with customer-relevant frameworks, including preparation for additional certifications like ISO 27001.

• Monitor GDPR and CCPA requirements, aligning policies and practices accordingly.

• Handle customer security questionnaires, RFI/RFP security sections, audits, and due diligence requests in collaboration with Sales and Sales Engineering.

• Develop and maintain a reusable library of approved security responses, documentation, and artifacts.

• Represent Korbyt during security review calls with customers and prospects.

• Identify security gaps that hinder enterprise deals and collaborate with Engineering and IT to ensure resolution.

• Draft, maintain, and enhance information security policies, standards, and procedures.

• Design and implement controls across access management, change management, vendor management, data handling, and employee lifecycle.

• Conduct access reviews, risk assessments, and internal audits; keep the risk register and remediation plans updated.

• Communicate security and compliance status to executive leadership using practical metrics.

• Oversee vulnerability management and coordinate remediation efforts with Engineering and IT.

• Manage incident response, lead investigations, perform post-incident reviews, and handle customer communications as necessary.

• Collaborate with Engineering to integrate security requirements into the development lifecycle, reviewing security implications of products, technologies, and integrations.

• Maintain business continuity and disaster recovery documentation and testing with a focus on security considerations.

• Select and manage external security vendors, including penetration testing firms, auditors, and managed security or monitoring services.

• Oversee the third-party vendor risk program, including new-vendor security evaluations and periodic reassessments.

• Implement the security awareness program, which encompasses onboarding training, annual refreshers, and phishing simulations.

• Foster practical security accountability across various business functions.

⛳️ Requirements

• 6–10 years of direct experience in security and compliance within a SaaS or technology company.

• Proven experience managing a SOC 2 Type II audit cycle, including evidence collection and auditor engagement.

• Experience handling customer security questionnaires, RFI/RFP security responses, and customer security reviews for enterprise clients.

• Proficient in using a GRC platform such as Vanta, Drata, or Secureframe.

• Strong knowledge of cloud security (AWS and/or Azure), identity and access management, and vulnerability management.

• Ability to write clear, audit-ready policies and procedures, and to communicate security posture effectively to customers, auditors, and executives.

• Experience in coordinating incident response and collaborating directly with engineering teams for remediation.

• Self-sufficient, organized, and accountable as a one-person security function, capable of achieving results without a team.

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.

• Industry certifications such as CISSP, CISM, CCSP, CISA, or ISO 27001 Lead Implementer/Auditor are preferred.

• Experience guiding a company through ISO 27001 readiness or certification is preferred.

• Background in a PE-backed or high-growth SaaS company where security played a role in the sales process is preferred.

• Familiarity with application security practices and secure SDLC is preferred.

🏝️ Benefits

• Fully remote work arrangement.