Fractional CISO

Arcanys; United States; Remote; USD 165,000 - 248,000; Part time

Job summary

Arcanys is seeking a Fractional CISO (vCISO) to lead security governance for a remote, distributed team. The role targets SOC 2 Type 2 and ISO 27001 compliance within a software outsourcing context.

You will drive cross-border compliance, incident and policy management, and vendor assessments while mentoring staff and communicating with non-technical stakeholders. Remote engagement is 20-30 hours/week.

Qualifications

• Experience leading security governance in mid-sized companies (200–500 employees).
• SOC 2 Type 2 or ISO 27001 certification required.
• Strong SDLC, CI/CD security, and cloud platforms (AWS, Google Workspace).
• Ability to explain security concepts to both junior technical staff and non-technical stakeholders.
• Experience with client security audits and vendor assessments.
• Experience working with distributed teams (Europe/Asia/Australia); startup exposure a plus.
• CISSP, CISM or CISA certifications preferred.

Responsibilities

• Develop security procedures and policies to meet SOC 2 Type 2 and ISO 27001 controls.
• Design a 12-month security roadmap balancing quality and agility.
• Establish a Risk Register and prioritize remediation by business impact.
• Ensure GDPR, Philippines Data Privacy Act and Australian Privacy Act compliance across regions.
• Standardize responses to client security questionnaires to accelerate sales.
• Draft and implement Incident Response, Access Control, and DR/BCP policies.
• Oversee selection and implementation of security tools (EDR, SIEM, scanners) without over-complicating the stack.

Skills

Security governance leadership

SOC 2 Type 2 / ISO 27001 certification

SDLC security

CI/CD security

Cloud platforms (AWS, Google Workspace

Security audits & vendor assessments

Communication & mentoring

Education

CISSP / CISM / CISA certifications

Tools

EDR

SIEM

Vulnerability Scanners

Job description

About Arcanys

Arcanys launched in 2010 to help entrepreneurs and innovators from Australia, Europe and other parts of the globe accelerate their software development with dedicated remote engineers from the Philippines.

Why work with us?

There’s a unique spirit to Arcanys—manifested in our amazing talents, passion for technology, and a strong focus on everyone’s career and personal development. As a company rooted in people, we make a point to offer exciting work opportunities and foster a culture that everyone can meaningfully contribute to.

Join us as a: Fractional CISO (vCISO)

Location: Remote

Engagement: Fractional (20-30 hours/week)

Key Responsibilities

1. Security Strategy

• Develop procedures, policies, work instructions to fulfill the controls from SOC2Type2 and ISO27001
• Design a 12-month security roadmap that balances "Swiss Quality" expectations with the agility of a software outsourcing firm.
• Establish a Risk Register and prioritize remediation based on business impact.

2 . Cross-Border Compliance

• Ensure all data handling meets the European GDPR, the Philippines Data Privacy Act and the Australian Privacy Act standards, among other regulations.
• Standardize our response to client security questionnaires to accelerate the sales cycle.

3. Incident & Policy Management

• Draft and implement core policies (Incident Response, Access Control, BCP/DR) that are practical, not just theoretical.
• Oversee the selection and implementation of essential security tools (EDR, SIEM, Vulnerability Scanners) without over-complicating the stack.

Who You Are (Requirements)

• Proven experience leading security governance in mid-sized companies (200–500 employees), including SOC 2 Type2 or ISO 27001 certification, ideally in outsourcing/software services companies.
• Strong technical foundation across SDLC, CI/CD security, and cloud platforms (AWS, Google Workspace).
• Effective communicator and mentor, able to explain security concepts to both junior technical staff and non-technical stakeholders.
• Experience handling client security audits and vendor assessments.
• Experience working with distributed teams (Europe/Asia/Australia) and with early-stage startups is a plus.
• Relevant certifications such as CISSP, CISM, or CISA preferred.