Security & Compliance Lead

Archlet; Spanien; Hybrid; EUR 90.000 - 130.000; Vollzeit

Zusammenfassung

Archlet is seeking an experienced security and compliance lead to work directly with the CTO/CISO. You will own daily security operations, ISO 27001 program, audits, and data privacy governance in a fast-growing SaaS scale-up.

You’ll coordinate penetration tests, manage vendor risk, and help customers understand our safeguards. You’ll collaborate with engineering to strengthen cloud security and secure development, shaping Archlet’s security posture.

Qualifikationen

• Typically 5+ years in information security, security compliance, or GRC in a SaaS/cloud environment.
• Strong ISO 27001 and proven SOC 2 experience.
• Technical depth to work effectively with engineers and understand cloud architecture, authentication, least privilege, and risk remediation.
• Practical privacy and risk-management skills with GDPR experience including DPAs and data transfers.
• Clear communication with customers and colleagues in English; able to explain safeguards clearly.
• Reliable execution across teams, prioritizing work and escalating risks early.
• An adaptable, practical approach with willingness to tackle both recurring work and new security challenges.

Aufgaben

• Keep Archlet secure and audit-ready. Own ISO 27001 program, maintain policies and evidence, coordinate audits, and ensure corrective actions.
• Lead our first SOC 2 Type II program in 2027, manage auditor, extend controls and evidence collection, and own the ongoing program.
• Help customers confidently choose Archlet by answering security questions and maintaining Trust Center materials.
• Turn security, privacy, and AI risks into action by maintaining risk registers, handling vendor assessments, and GDPR compliance documents.
• Lead penetration testing and remediation; coordinate with engineering on findings and verification.
• Improve security across product and workplace by partnering with Engineering on cloud security, identity, secure development, and incident preparedness.
• Make secure working easier with training, phishing exercises, and automation to accelerate evidence collection and security reviews.

Kenntnisse

Security governance

ISO 27001

SOC 2

Cloud security

Audit management

GDPR

Vanta

Penetration testing

Vendor risk management

Technical depth

Tools

Vanta

Azure

Entra ID

Intune

Microsoft Defender

Jobbeschreibung

You have an engineering background, understand our technical setup, and can proactively shape our security posture. In our fast-growing scale-up, you’ll take on a wide variety of tasks, with real ownership and room to be creative. Your pragmatic, can-do mindset helps you find solutions that let Archlet move fast while staying secure and compliant. You’re a great team player who loves software engineering and wants to help Archlet grow.

Your mission

Working directly with our CTO/CISO, you’ll own the daily execution of security and compliance at Archlet. Your priorities will shift between customer requests, audits, and security improvements, giving you broad responsibility and visible impact.

• Keep Archlet secure and audit-ready. Own our ISO 27001 compliance program, maintain policies and evidence in Vanta, coordinate internal and external audits, and ensure control owners complete their responsibilities and corrective actions.
• Lead our first SOC 2 Type II program in 2027. Build and execute the plan, select and manage the auditor, extend our existing controls and Vanta setup, and coordinate evidence collection through the examination period and final report. Own the recurring program afterward.
• Help customers confidently choose Archlet. Be the first point of contact for security and compliance questions across the company. Complete customer assessments, explain our safeguards clearly, and maintain our Trust Center and reusable answers to make future requests faster.
• Turn security, privacy, and AI risks into action. Maintain our risk registers, assess vendors, and keep subprocessor information current. Drive operational GDPR compliance and maintain documents such as DPAs, privacy assessments, and AI governance records, involving legal specialists when needed.
• Lead penetration testing and security remediation. Coordinate our annual independent pentest from scope and preparation through findings review, engineering tickets, retesting, and customer-facing reports. Work with engineering to prioritize findings and confirm that remediation addresses the underlying risk.
• Improve security across our product and workplace. Partner with Platform and Application Engineering on cloud security, identity, secure development, and security validation of new features. Run access reviews, manage security-tool findings and routine security configurations, and coordinate recovery tests and incident-response preparation.
• Make secure working easier and more efficient. Deliver practical employee and engineering training, run phishing exercises, and improve how we work through automation and thoughtful use of AI—for example, accelerating questionnaires, collecting evidence, and supporting security reviews.

About you

• Experience owning delivery. Typically 5+ years in information security, security compliance, or GRC, with substantial responsibility in a SaaS or cloud-based software environment. You have personally operated programs and closed gaps, with results beyond recommendations and audit reports.
• Strong ISO 27001 and proven SOC 2 experience. You have independently managed an ISO 27001 audit cycle and held substantial delivery responsibility for a completed SOC 2 Type II cycle. You understand control design, operating evidence, auditor expectations, and remediation. Leading a first-time SOC 2 program is particularly valuable.
• Technical depth to work effectively with engineers. You understand cloud architecture, authentication and authorization, least privilege, endpoint protection, logging, and common application vulnerabilities. You can assess findings, challenge proposed solutions constructively, and agree on evidence that demonstrates a fix. Writing application code or opening PRs is not required.
• Practical privacy and risk-management skills. You have handled vendor assessments, risk registers, and operational GDPR requirements, including data processing agreements, retention, and international transfers. You can resolve routine questions independently and recognize when specialist legal advice is needed.
• Clear communication with customers and colleagues. You have completed enterprise security questionnaires and can explain technical safeguards accurately in excellent written and spoken English. You distinguish existing capabilities from planned improvements and avoid making unsupported commitments.
• Reliable execution across teams. You organize competing requests, manage external providers, follow up with contributors, and drive work through to completion. You make sensible tradeoffs and escalates material risks or capacity conflicts early.
• An adaptable, practical approach. You enjoy both detailed recurring work and new security challenges. You are comfortable switching from a lengthy questionnaire to audit preparation or an engineering discussion, and you actively improve processes that create unnecessary work.

Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance is valuable. ISO 42001 experience is a bonus for potential future work.

We have a strong, international team of people with experience both in large enterprises like Google and Microsoft, but also experience in founding and growing tech startups. We push each other to higher degrees of product and engineering excellence, while looking at everything we do with a business mindset.

You’ll have the autonomy to drive design decisions and make a real impact, with little bureaucracy and meetings, all within a supportive and innovative environment. We foster a culture of creativity and collaboration, with regular team activities, both virtual and in person.

Archlet is on a healthy growth trajectory, already has renowned customers like Walmart and PepsiCo, and has an exciting product roadmap that needs you to succeed.