Lead - Security, Risk & Compliance

Embrace Software Inc; India; Remote; INR 4,000,000 - 8,000,000; Full time

Job summary

Embrace Technology Group is seeking a Lead - Security, Risk & Compliance to establish a unified security program across portfolio companies. The role is remote with collaboration to India-based engineering teams.

You will implement security controls, manage audits, and strengthen governance across education, government, and legal sector customers. The position requires 10+ years in cybersecurity, hands-on cloud security, and extensive audit experience.

Qualifications

• 10+ years of cybersecurity, risk management, and compliance ownership including SOC 2 or ISO 27001.
• Proven experience developing security policies, control frameworks, risk assessments, and audit evidence with remediation plans.
• Hands-on cloud and application security across AWS/Azure including IAM, encryption, API security, and vulnerability management.
• Experience with security tools such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, and endpoint security.
• Experience with vendor risk, security audits, and customer security reviews in regulated SaaS environments.
• Strong leadership, communication, and mentoring skills for distributed teams.

Responsibilities

• Develop and maintain a centralized security control framework and evidence templates across portfolio companies.
• Lead SOC 2 Type I/II engagements end-to-end including readiness, evidence, and auditor coordination.
• Lead ISO 27001 implementation with ISMS scoping and management reviews.
• Manage government, education, and legal-sector security requirements (FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53).
• Conduct risk assessments, maintain risk registers, and escalate material risks to leadership.
• Oversee vulnerability assessments, penetration testing, and remediation prioritization across apps and infra.
• Conduct third-party and vendor security assessments including subprocessors and AI vendors.
• Develop business continuity, disaster recovery, and secure development standards; coordinate testing with operations.
• Manage customer security reviews, questionnaires, and audit evidence with external auditors.

Skills

Security leadership

SOC 2

ISO 27001

Cloud security

Vulnerability management

Audit management

Risk assessment

Vendor risk

Security frameworks

Program governance

Tools

Cloudflare/WAF

SIEM

Drata/Vanta

Job description

We're rebuilding vertical software with AI — from the inside.

Embrace owns the software running inside 16% of the Fortune 500, 45+ state agencies, and 450+ banks and credit unions. We acquire entrenched vertical software businesses and rebuild them around AI — products, operations, go-to-market, all of it. Our Venture Lab launches new AI-native products into those same markets, using the distribution and customer relationships our portfolio already owns.

You’ll ship AI into production against real workflows, real customers, and a P&L you can see move within a quarter.

We hire people who want scope, speed, and ownership, and who are tired of working on AI that never reaches a customer. If you want to spend the next five years shipping into software that already runs the economy, talk to us.

Job Description

This is a remote position.

The Embrace Technology Group provides shared engineering, cloud, and security services across Embrace portfolio companies in education, government, and legal sectors. This remote role reports to the Director, Cloud Operations & Enterprise IT and works closely with the engineering team in India.

The Lead - Security, Risk & Compliance will establish and manage a centralized security and compliance framework across the portfolio, including policies, SOC 2 and other certifications, risk management, and customer security requirements. The role will be responsible for implementing security standards, addressing compliance gaps, and supporting enterprise customer requirements.

In addition to governance and compliance, this is a hands‑on security role requiring strong technical expertise. The Lead will implement security controls, assess risks, evaluate security tools, and work closely with Security, CloudOps, and Engineering teams to strengthen security across the portfolio.

The role will initially focus on establishing common controls, supporting existing teams, and managing audits, with the security function expanding as the portfolio grows.

Key Responsibilities

• Develop, implement, and maintain a centralized security control framework, including policies, controls, and evidence templates across portfolio companies.
• Lead SOC 2 Type I and Type II engagements end to end, including readiness, control implementation, evidence collection, auditor coordination, and reporting.
• Lead ISO 27001 implementation and certification where required, including ISMS scoping, Statement of Applicability, internal audits, and management reviews.
• Manage applicable government, education, and legal-sector security requirements, including FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53, and contractual security obligations.
• Conduct security risk assessments, maintain risk registers, track remediation and exceptions, and elevate material risks for formal acceptance by business leadership.
• Manage vulnerability assessments, penetration testing, remediation priorities, and tracking of security findings across applications and infrastructure.
• Conduct third-party and vendor security assessments, including subprocessors, software supply chains, and AI vendors.
• Develop and maintain business continuity, disaster recovery, security awareness, and secure development standards, coordinating testing and compliance with operational teams.
• Manage customer security reviews, questionnaires, audit evidence, and external auditor interactions across portfolio companies.
• Establish and improve security processes, reporting, and controls across the portfolio, providing regular updates on risks, compliance, and remediation progress.

Technical Security Leadership & Operations

• Implement and improve security controls across cloud, application, and infrastructure environments, working with CloudOps and Engineering teams.
• Evaluate, configure, and optimize security tools, including Cloudflare/WAF, vulnerability scanners, SIEM, endpoint protection, and security monitoring platforms.
• Conduct technical security reviews covering IAM, SSO/SAML, encryption, API security, privileged access, customer data isolation, and third-party integrations.
• Assess security vulnerabilities, recommend remediation, and work with Engineering and Systems Administration to implement and validate corrective actions.
• Review cloud and infrastructure security configurations, including firewall policies, DDoS protection, access controls, and security hardening.
• Provide hands-on technical support and guidance to security analysts and engineering teams on security controls, tooling, compliance requirements, and complex security issues.
• Mentor security team members, establish security best practices, and improve internal capabilities through regular reviews and knowledge sharing.

Requirements

• 10+ years of experience in cybersecurity, risk management, and compliance, including end-to-end ownership of SOC 2 Type II or ISO 27001 certification.
• Proven experience developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation plans, using platforms such as Drata or Vanta.
• Strong hands‑on experience with cloud and application security across AWS and/or Azure, including IAM, encryption, API security, secure development practices, and vulnerability management.
• Practical experience implementing and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools.
• Experience conducting technical security assessments, identifying vulnerabilities, implementing security controls, and validating remediation with Engineering and CloudOps teams.
• Experience managing vendor risk, security audits, and customer security reviews, preferably within education, government, legal, or other regulated SaaS environments.
• Strong technical leadership, communication, and mentoring skills, with the ability to work independently and collaborate across multiple portfolio companies and distributed teams.

Nice to Have

• Experience with AI security and governance, including model risk assessments, prompt injection, data privacy, tenant isolation, and secure AI integrations.
• Familiarity with AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, and privacy regulations such as GDPR.
• Experience with security and compliance requirements in FinTech or financial services, including protection of sensitive financial data.
• Knowledge of FedRAMP/StateRAMP, HECVAT, and security requirements for education, government, and legal SaaS environments. Certifications such as CISSP, CISM, CISA, CRISC, or CCSP are a plus.
• Experience securing Microsoft SQL Server, Windows Server, Java applications, SAML/Shibboleth, and managed hosting environments.
• Competitive salary commensurate with experience.
• Opportunities for career advancement and professional development.
• Experience collaborating with a diverse, global team within a remote work setting.