Chief Information Security Officer

Sprites; San Francisco (CA); Presencial; USD 230.000 - 360.000; Jornada completa

Descripción de la vacante

Campfire, an AI-native ERP and financial automation platform, is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises.

You will turn that into an in-house program that closes deals faster and keeps us safe. The CISO will lead SOC 1/2 audits, ISO 27001 adoption, privacy governance, and incident response while partnering with Legal, Sales and Engineering. Bay Area preferred for location.

Formación

• 10+ years in security, with 3+ leading a program at a B2B SaaS company.
• Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.
• Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.
• Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.
• Working knowledge of GDPR, DPAs and contract security terms.
• Has led real incident response, including customer communication.

Responsabilidades

• Lead customer security reviews, deal support, and security collateral.
• Own SOC 1/SOC 2 audits: scope, auditor management, bridge letters.
• Drive ISO 27001 implementation and other frameworks as requested.
• Oversee privacy, DPAs, GDPR mechanisms, and vendor security.
• Own incident response, breach notification decisions, and post-incident reports.
• Manage identity and access, including Okta SSO, MFA, and SCIM integration.
• Maintain resilience policies, BCDR, and incident testing.
• Guide AI security discussions: model governance, prompts retention, logging.

Conocimientos

Security leadership

SOC audits

ISO 27001

AWS security

Okta IAM

GDPR/DPAs

Incident response

SIEM tooling

Fintech/ERP background

Herramientas

AWS

Okta

Google Workspace

EDR

SIEM

Descripción del empleo

About Campfire
Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an AI-native platform that helps finance teams move faster and operate more efficiently.
The role

Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises.

• Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital.

• Customers trust us with their general ledger, bank details, payroll and vendor data.

• Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews.

• You will turn that into an in-house program that closes deals faster and keeps us safe.

What you'll own

Customer security reviews and deal support

• Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.

• Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.

• Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.

Compliance and audits

• Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.

• Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.

• Run Vanta as the system of record for controls and evidence.

Privacy and contracts

• Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.

• Review security and audit-cooperation clauses in customer contracts.

• Own data retention, export and residency answers, including new-region or GovCloud requests.

Security operations and incident response

• Own the incident response plan, run tabletop tests, and lead response when incidents happen.

• Own customer breach notification decisions and post-incident write-ups.

• Own detection and email security: SIEM, EDR, email protection, identity alerting.

Identity and access

• Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production.

• Support customer-facing SSO/SCIM setups.

Resilience and policy

• Own BCDR plans, RTO/RPO targets, backup and restore testing.

• Maintain information security, responsible AI and vendor management policies.

• Run background and sanctions screening for employees and vendors.

AI security

• Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out.

• Govern AI vendors and subprocessors.

First 90 days

1. Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales.

2. Finish the Vanta migration and publish a trust center with standard collateral.

3. Finalize and test the BCDR and incident response plans.

4. Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage.

5. Present a 12-month security and certification roadmap to the CTO.

What we're looking for

• 10+ years in security, with 3+ leading a program at a B2B SaaS company.

• Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.

• Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.

• Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.

• Working knowledge of GDPR, DPAs and contract security terms.

• Has led real incident response, including customer communication.

• Fintech, ERP or accounting software background a strong plus.

• Pragmatic builder: starts as a team of one, hires as we grow.

Reporting and logistics

• Reports to the CEO. Works closely with Sales, Legal and Engineering.

• Location: Bay Area preferred.