Lead Information Security Compliance

Job Summary

To establish a robust security and compliance framework, the full-time remote Lead Information Security Compliance will manage SOC 2 and ISO 27001 certifications, implement security standards, and conduct risk assessments while collaborating with engineering teams across the portfolio.

Key Responsibilities

• Develop and maintain a centralized security control framework, including policies and evidence templates across portfolio companies
• Lead SOC 2 Type I and Type II engagements, managing auditor coordination, control implementation, and reporting
• Conduct security risk assessments and manage vulnerability assessments, prioritizing remediation across applications and infrastructure

Required Qualifications

• 10+ years of experience in cybersecurity, risk management, and compliance, including SOC 2 Type II or ISO 27001 certification
• Proven experience developing and implementing security policies, control frameworks, and risk assessments
• Strong hands-on experience with cloud and application security across AWS and/or Azure
• Practical experience with security technologies such as Cloudflare/WAF, firewalls, and SIEM
• Experience managing vendor risk and conducting security audits within regulated SaaS environments