Lead, Information Security, Risk & Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, execute, and sustain a comprehensive security control framework, which encompasses policies, controls, and evidence templates for portfolio companies.

• Oversee SOC 2 Type I and Type II engagements from start to finish, covering readiness, control execution, evidence gathering, auditor collaboration, and reporting.

• Spearhead the implementation and certification of ISO 27001 when necessary, including ISMS scoping, Statement of Applicability, internal audits, and management reviews.

• Supervise security requirements in government, healthcare, education, and legal sectors, including HIPAA, FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53, and contractual security obligations.

• Perform security risk assessments, maintain risk registers, track remediation and exceptions, and escalate significant risks for formal acceptance by business leadership.

• Direct vulnerability assessments, penetration testing, remediation priorities, and the tracking of security findings throughout applications and infrastructure.

• Conduct third-party and vendor security assessments, including subprocessors, software supply chains, and AI vendors.

• Create and uphold standards for business continuity, disaster recovery, security awareness, and secure development, coordinating testing and compliance with operational teams.

• Manage customer security reviews, questionnaires, audit evidence, and interactions with external auditors across portfolio companies.

• Establish and enhance security processes, reporting, and controls across the portfolio, providing regular updates on risks, compliance, and remediation status.

• Execute and refine security controls across cloud, application, and infrastructure environments in collaboration with CloudOps and Engineering teams.

• Assess, configure, and optimize Cloudflare/WAF, vulnerability scanners, SIEM, endpoint protection, and security monitoring solutions.

• Perform technical security evaluations focusing on IAM, SSO/SAML, encryption, API security, privileged access, customer data isolation, and third-party integrations.

• Identify security vulnerabilities, advise on remediation, and collaborate with Engineering and Systems Administration to implement and validate corrective measures.

• Review security configurations for cloud and infrastructure, including firewall policies, DDoS protection, access controls, and security hardening measures.

• Provide direct technical support and guidance to security analysts and engineering teams regarding security controls, tools, compliance requirements, and complex security challenges.

• Mentor members of the security team, establish security best practices, and enhance internal capabilities through ongoing reviews and knowledge sharing.

⛳️ Requirements

• Over 10 years of experience in cybersecurity, risk management, and compliance, with comprehensive ownership of SOC 2 Type II or ISO 27001 certification.

• Demonstrated expertise in developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation strategies, utilizing platforms like Drata or Vanta.

• Extensive hands-on experience with cloud and application security across AWS and/or Azure, covering IAM, encryption, API security, secure development practices, and vulnerability management.

• Practical knowledge in deploying and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools.

• Experience in conducting technical security assessments, identifying vulnerabilities, applying security controls, and validating remediation efforts with Engineering and CloudOps teams.

• Background in managing vendor risk, conducting security audits, and facilitating customer security reviews, preferably within educational, governmental, legal, or other regulated SaaS environments.

• Strong technical leadership, communication, and mentorship abilities, with a capacity for independent work and collaboration across multiple portfolio companies and distributed teams.

• Familiarity with AI security and governance, including model risk assessments, prompt injection, data privacy, tenant isolation, and secure AI integrations.

• Knowledge of AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, along with privacy regulations including GDPR.

• Experience with security and compliance mandates in FinTech or financial services, particularly in safeguarding sensitive financial information.

• Understanding of FedRAMP/StateRAMP, HECVAT, and security standards relevant to educational, governmental, and legal SaaS environments.

• Certifications such as CISSP, CISM, CISA, CRISC, or CCSP are advantageous.

• Experience securing Microsoft SQL Server, Windows Server, Java applications, SAML/Shibboleth, and managed hosting environments.

🏝️ Benefits

• Competitive salary commensurate with experience.

• Opportunities for career advancement and professional growth.

• Experience working with a diverse, global team in a remote work environment.