Security & Compliance Lead

This is a fully remote position, open to applicants in Spain.

📋 Description

• Take charge of the daily implementation of security and compliance at Archlet.

• Oversee the ISO 27001 compliance program, manage policies and evidence within Vanta, coordinate both internal and external audits, and ensure that control owners fulfill their responsibilities and corrective actions.

• Develop and implement Archlet’s inaugural SOC 2 Type II program in 2027, which includes selecting and managing auditors, extending control and Vanta setups, coordinating evidence, and preparing the final report.

• Act as the primary point of contact for security and compliance inquiries throughout the company.

• Conduct customer assessments, clarify security measures, and maintain the Trust Center along with reusable responses.

• Keep risk registers updated, evaluate vendors, and ensure subprocessor information is current.

• Promote operational GDPR compliance while managing Data Processing Agreements (DPAs), privacy assessments, and AI governance records.

• Lead annual independent penetration testing from the scope and preparation stage through to findings review, engineering tickets, retesting, and customer-facing reports.

• Collaborate with Platform and Application Engineering on cloud security, identity management, secure development practices, and validating security for new features.

• Conduct access reviews, handle security tool findings and routine security configurations, and coordinate recovery tests and incident-response preparations.

• Provide employee and engineering training and conduct phishing simulations.

• Enhance security processes through automation and the strategic application of AI.

⛳️ Requirements

• Background in engineering.

• Generally, 5+ years of experience in information security, security compliance, or Governance, Risk, and Compliance (GRC).

• Significant responsibility within a SaaS or cloud-based software setting.

• Hands-on experience managing security programs and addressing gaps, yielding results that exceed mere recommendations and audit reports.

• Strong expertise in ISO 27001.

• Independently directed an ISO 27001 audit cycle.

• Significant accountability for a completed SOC 2 Type II cycle.

• Knowledge of control design, operational evidence, auditor expectations, and remediation processes.

• Technical proficiency in cloud architecture, authentication and authorization, least privilege access, endpoint protection, logging, and common application vulnerabilities.

• Experience managing vendor assessments, risk registers, and operational GDPR obligations, including data processing agreements, data retention, and international transfers.

• Experience in completing enterprise security questionnaires.

• Excellent proficiency in written and spoken English.

• Capability to organize competing requests, manage external vendors, follow up with contributors, and drive tasks to completion.

• Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance is advantageous.

• ISO 42001 experience is a plus.

🏝️ Benefits

• Permanent full-time employment.

• Freedom to influence design decisions and create meaningful impacts.

• Minimal bureaucracy and meetings.

• A supportive and innovative workplace.

• Regular team activities, both virtual and in-person.