Information Security Lead

This is a fully remote position, open to applicants in United States.

📋 Description

• Manage ISO 27001 and ISO 42001 management systems through ongoing evidence gathering, risk management, control assessments, internal audits, management reviews, corrective actions, and preparation for surveillance audits.

• Develop and maintain security operations encompassing centralized logging, detection engineering, alert triage, incident response, security investigations, insider-risk escalation, tabletop exercises, and improvements following incidents.

• Take ownership of the information security operating model, which includes policies, standards, risk acceptance, vulnerability governance, quarterly leadership reports, security awareness, and the maturity roadmap for the function.

• Direct identity, access, vendor, and data-protection controls through privileged-access governance, quarterly evaluations, third-party assessments, classification, retention, deletion, and delineation between operating companies.

• Deliver independent technical assurance across applications and cloud systems by analyzing architecture, application code, infrastructure-as-code, IAM policies, CI/CD workflows, and significant vulnerabilities.

• Create security and governance controls for AI systems, which encompass inventories, impact assessments, model and tool access, agent permissions, risks of prompt injection and data exfiltration, audit trails, and validated shutdown mechanisms.

• Report to the IT Systems Manager; collaborate with platform, application, and AI engineering teams; work with Legal on privacy matters; and engage with the CTO as the executive sponsor.

⛳️ Requirements

• Over 7 years of experience in information security, including managing ISO 27001 programs.

• Active CISSP certification is required, or a commitment to obtain it within six months of hiring.

• Preferred experience in ISO 42001 and CGRC.

• Proven experience in remediating security incidents, including establishing logging, monitoring, and detection capabilities.

• Proficiency in reading and writing code, preferably in Python and JavaScript/TypeScript.

• Familiarity with infrastructure-as-code tools like Pulumi or Terraform, cloud IAM, and deployment workflows.

• Understanding of AI and agentic systems, with experience in implementing effective security controls.

• Highly preferred experience in serving as a foundational or sole information security owner.

• Availability for full-time work during standard Pacific Time business hours, Monday through Friday.

• Flexibility to respond to security incidents and urgent business requirements.

• Remote position based in the USA; some travel to Las Vegas will be necessary.

• Must be authorized to work in the U.S. without requiring sponsorship.

🏝️ Benefits

• Flexible Unlimited Paid Time Off and Company-wide Holidays.

• Employer-sponsored Medical, Dental, & Vision plans.

• Annual Employer HSA contribution of $1,950.

• FSA options, including dependent care.

• Employee assistance program and mental health resources.

• Employer match program for 401(k), available for both Traditional and Roth accounts.

• Annual wellness reimbursement of $1,200 through JOON, supporting health, family care, pet care, fitness, and more.

• Access to a state-of-the-art gym at the HQ in Las Vegas for local or visiting team members.