Lead – Security, Risk & Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Establish and oversee a centralized security and compliance framework across the portfolio companies.

• Create, implement, and sustain security policies, controls, and evidence templates.

• Lead SOC 2 Type I and Type II engagements from start to finish, covering readiness, control implementation, evidence collection, auditor coordination, and reporting.

• Spearhead ISO 27001 implementation and certification, including ISMS scoping, Statement of Applicability, internal audits, and management reviews.

• Manage security requirements for government, education, and legal sectors, including FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53, and contractual obligations.

• Conduct security risk assessments, maintain risk registers, track remediation and exceptions, and escalate significant risks.

• Oversee vulnerability assessments, penetration testing, remediation priorities, and security findings across applications and infrastructure.

• Perform third-party and vendor security assessments, including subprocessors, software supply chains, and AI vendors.

• Develop and maintain standards for business continuity, disaster recovery, security awareness, and secure development.

• Manage customer security reviews, questionnaires, audit evidence, and interactions with external auditors.

• Establish and enhance security processes, reporting, and controls across the portfolio.

• Implement and refine security controls across cloud, application, and infrastructure environments.

• Evaluate, configure, and optimize Cloudflare/WAF, vulnerability scanners, SIEM, endpoint protection, and security monitoring platforms.

• Conduct technical security reviews covering IAM, SSO/SAML, encryption, API security, privileged access, customer data isolation, and third-party integrations.

• Assess vulnerabilities, recommend remediation strategies, and validate corrective actions with Engineering and Systems Administration.

• Review cloud and infrastructure security configurations, including firewall policies, DDoS protection, access controls, and security hardening.

• Provide hands-on technical guidance to security analysts and engineering teams.

• Mentor security team members, establish best practices, and enhance internal capabilities through reviews and knowledge sharing.

⛳️ Requirements

• Over 10 years of experience in cybersecurity, risk management, and compliance, including full ownership of SOC 2 Type II or ISO 27001 certification.

• Demonstrated experience in developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation plans using platforms like Drata or Vanta.

• Strong hands-on experience with cloud and application security across AWS and/or Azure, covering IAM, encryption, API security, secure development practices, and vulnerability management.

• Practical experience in implementing and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools.

• Experience in conducting technical security assessments, identifying vulnerabilities, implementing security controls, and validating remediation with Engineering and CloudOps teams.

• Experienced in managing vendor risk, security audits, and customer security reviews, preferably in education, government, legal, or other regulated SaaS environments.

• Strong technical leadership, communication, and mentoring skills, with the ability to work independently and collaborate across multiple portfolio companies and distributed teams.

• Knowledge of AI security and governance, including model risk assessments, prompt injection, data privacy, tenant isolation, and secure AI integrations.

• Familiarity with AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, as well as privacy regulations like GDPR.

• Experience with security and compliance requirements in FinTech or financial services, including the protection of sensitive financial data.

• Knowledge of FedRAMP/StateRAMP, HECVAT, and security requirements for education, government, and legal SaaS environments.

• Certifications such as CISSP, CISM, CISA, CRISC, or CCSP are beneficial.

• Experience securing Microsoft SQL Server, Windows Server, Java applications, SAML/Shibboleth, and managed hosting environments.

🏝️ Benefits

• Competitive salary commensurate with experience.

• Opportunities for career advancement and professional development.

• Experience collaborating with a diverse, global team within a remote work environment.