Security & Compliance Lead

Archlet; Spanien; Vor Ort; EUR 90.000 - 130.000; Vollzeit

Zusammenfassung

Archlet is seeking an experienced security and compliance leader to work with our CTO/CISO, owning the daily execution of security and compliance across the organization.

You will drive ISO 27001 and SOC 2 programs, manage vendor risk, privacy obligations, and security improvements while enabling fast product growth and a trusted customer experience.

You’ll collaborate with engineering, product, and legal teams to translate risk into action and maintain our Trust Center for customers.

Qualifikationen

• Typically 5+ years in information security, security compliance, or GRC in SaaS/cloud environments.

Aufgaben

• Own ISO 27001 compliance program, maintain policies and evidence, coordinate audits.
• Lead SOC 2 Type II program planning and execution, manage auditor and evidence.
• Serve as primary security/compliance contact across the company and for customers.
• Maintain risk registers and GDPR artifacts (DPAs, privacy assessments, AI governance).
• Lead penetration testing and remediation with engineering teams.
• Improve security across product and workplace: cloud security, access reviews, security configurations.
• Deliver security training, run phishing exercises, and streamline security reviews using automation.

Kenntnisse

ISO 27001

SOC 2 Type II

Cloud security

GDPR

Audits & evidence

English communication

Vendor risk

Security governance

Tools

Vanta

Azure

Entra ID

Intune

Microsoft Defender

Jobbeschreibung

You have an engineering background, understand our technical setup, and can proactively shape our security posture. In our fast-growing scale-up, you’ll take on a wide variety of tasks, with real ownership and room to be creative. Your pragmatic, can-do mindset helps you find solutions that let Archlet move fast while staying secure and compliant. You’re a great team player who loves software engineering and wants to help Archlet grow.Working directly with our CTO/CISO, you’ll own the daily execution of security and compliance at Archlet. Your priorities will shift between customer requests, audits, and security improvements, giving you broad responsibility and visible impact.

• Keep Archlet secure and audit-ready. Own our ISO 27001 compliance program, maintain policies and evidence in Vanta, coordinate internal and external audits, and ensure control owners complete their responsibilities and corrective actions.
• Lead our first SOC 2 Type II program in 2027. Build and execute the plan, select and manage the auditor, extend our existing controls and Vanta setup, and coordinate evidence collection through the examination period and final report. Own the recurring program afterward.
• Help customers confidently choose Archlet. Be the first point of contact for security and compliance questions across the company. Complete customer assessments, explain our safeguards clearly, and maintain our Trust Center and reusable answers to make future requests faster.
• Turn security, privacy, and AI risks into action. Maintain our risk registers, assess vendors, and keep subprocessor information current. Drive operational GDPR compliance and maintain documents such as DPAs, privacy assessments, and AI governance records, involving legal specialists when needed.
• Lead penetration testing and security remediation. Coordinate our annual independent pentest from scope and preparation through findings review, engineering tickets, retesting, and customer-facing reports. Work with engineering to prioritize findings and confirm that remediation addresses the underlying risk.
• Improve security across our product and workplace. Partner with Platform and Application Engineering on cloud security, identity, secure development, and security validation of new features. Run access reviews, manage security-tool findings and routine security configurations, and coordinate recovery tests and incident-response preparation.
• Make secure working easier and more efficient. Deliver practical employee and engineering training, run phishing exercises, and improve how we work through automation and thoughtful use of AI—for example, accelerating questionnaires, collecting evidence, and supporting security reviews.

• Experience owning delivery. Typically 5+ years in information security, security compliance, or GRC, with substantial responsibility in a SaaS or cloud-based software environment. You have personally operated programs and closed gaps, with results beyond recommendations and audit reports.
• Strong ISO 27001 and proven SOC 2 experience. You have independently managed an ISO 27001 audit cycle and held substantial delivery responsibility for a completed SOC 2 Type II cycle. You understand control design, operating evidence, auditor expectations, and remediation. Leading a first-time SOC 2 program is particularly valuable.
• Technical depth to work effectively with engineers. You understand cloud architecture, authentication and authorization, least privilege, endpoint protection, logging, and common application vulnerabilities. You can assess findings, challenge proposed solutions constructively, and agree on evidence that demonstrates a fix. Writing application code or opening PRs is not required.
• Practical privacy and risk-management skills. You have handled vendor assessments, risk registers, and operational GDPR requirements, including data processing agreements, retention, and international transfers. You can resolve routine questions independently and recognize when specialist legal advice is needed.
• Clear communication with customers and colleagues. You have completed enterprise security questionnaires and can explain technical safeguards accurately in excellent written and spoken English. You distinguish existing capabilities from planned improvements and avoid making unsupported commitments.
• Reliable execution across teams. You organize competing requests, manage external providers, follow up with contributors, and drive work through to completion. You make sensible tradeoffs and elevate material risks or capacity conflicts early.
• An adaptable, practical approach. You enjoy both detailed recurring work and new security challenges. You are comfortable switching from a lengthy questionnaire to audit preparation or an engineering discussion, and you actively improve processes that create unnecessary work.
• Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance is valuable. ISO 42001 experience is a bonus for potential future work.

We have a strong, international team of people with experience both in large enterprises like Google and Microsoft, but also experience in founding and growing tech startups. We push each other to higher degrees of product and engineering excellence, while looking at everything we do with a business mindset.
You'll have the autonomy to drive design decisions and make a real impact, with little bureaucracy and meetings, all within a supportive and innovative environment. We foster a culture of creativity and collaboration, with regular team activities, both virtual and in person.
Archlet is on a healthy growth trajectory, already has renowned customers like Walmart and PepsiCo, and has an exciting product roadmap that needs you to succeed.