Information Security Lead

PeopleFinders; United States; On-site; USD 150,000 - 165,000; Full time

Benefits offered by this job

Flexible PTO

401K match

Medical, dental, vision coverage

Dependent coverage

Job summary

PeopleFinders, LLC in the United States is seeking an Information Security Lead to own day-to-day security across applications, infrastructure, and internal systems, focusing on detection, response, and durable controls. You will lead incident response, translate threat intel into clear remediation plans, and collaborate with engineering to embed security into CI/CD, cloud, and data platforms.

The role requires hands-on security experience and strong communication with leadership, with a salary

Qualifications

• 5+ years in information security with hands-on experience in at least three areas.
• Experience leading security incidents from detection through root cause and reporting.
• Hands-on experience securing AWS and internet-facing web applications and APIs; knowledge of OWASP risks.
• Experience with firewalls and VPN/remote-access security; endpoint protection (EDR/AV).
• Experience with WAF, bot management, DDoS protection, and CDN security.
• Strong log analysis across multiple sources; IAM, MFA, encryption, and secrets management.

Responsibilities

• Lead investigations of security alerts and incidents end to end, including scope, evidence, containment, root-cause analysis, and remediation.
• Coordinate with the MDR provider, triage escalations, and track findings to closure.
• Write status updates and post-incident reports for leadership, engineering, and external parties.
• Maintain incident response procedures, runbooks, and evidence-handling practices.
• Assess newly disclosed vulnerabilities and supply-chain events against our environment, separating real exposure.
• Run vulnerability scanning and coordinate penetration tests, and track remediation.
• Review architecture, authentication flows, and code changes for security risk in applications and APIs.
• Lead bot mitigation, scraping prevention, fraud signals, rate limiting, and traffic analysis.
• Secure AWS environments, including identity, logging, threat detection, and configuration baselines, and container workloads.
• Manage network security, MFA, and remote access policies; enforce device management and coverage.
• Drive least-privilege access and secrets management; periodic access reviews.
• Support SOC 2, PCI DSS, privacy obligations with evidence and control improvements.

Skills

Incident response

Cloud security

Application security

Network security

Vulnerability management

Log analysis

IAM & encryption

Scripting (Python/PowerShell)

Security governance/compliance (SOC 2/

Executive communication

Education

Security certifications (CISSP, GIAC, AWS Security Specialty, PCNSE, or Security+)

Tools

AWS

Cloudflare

DataDome

EDR/AV

WAF

CI/CD security tools

Vulnerability scanners

Job description

PeopleFinders.com, the premier online service for consumers to locate, contact and verify people and businesses. Over the past couple of decades the Company has quietly become one of the largest owners of public records data in the country, distributing its products over a vast network of websites.

About PeopleFinders

PeopleFinders.com provides people search, public records, background information, and property data services to millions of customers. Our platforms process large volumes of sensitive data and serve high-traffic consumer websites.

Position Overview

The Information Security Lead owns day-to-day security for PeopleFinders’ applications, infrastructure, and internal systems, from detecting and responding to threats to building durable controls with engineering teams. The role leads incident response, turns new vulnerabilities and threat intelligence into clear “are we affected” answers and remediation plans, and keeps leadership informed with proportionate, evidence-based updates.

This is a hands-on role for someone who thinks like an attacker, verifies before acting, and gets changes done through collaboration.

Salary

Salary - $150k-$165k

Responsibilities

Threat detection and incident response

• Lead investigations of security alerts and incidents end to end: scoping, evidence collection and preservation, containment, root-cause analysis, and corrective actions.
• Coordinate with the managed detection and response provider, triage escalations, and track findings to closure.
• Write clear status updates and post-incident reports for leadership, engineering, and external parties where needed.
• Maintain incident response procedures, runbooks, and evidence-handling practices.

Vulnerability and threat response

• Assess newly disclosed vulnerabilities and supply-chain events against our environment within hours (applications, containers, cloud, network devices, endpoints), separating real exposure from headline severity.
• Run vulnerability scanning and external scanning programs, coordinate penetration tests, and track remediation against defined timelines.
• Track vendor fixes and verify remediation once deployed.

Application, API, and abuse protection

• Protect web applications and APIs; review architecture, authentication flows, and code changes for security risk.
• Lead bot mitigation, scraping prevention, fraud signals, rate limiting, and traffic analysis using Cloudflare, DataDome, or similar platforms.
• Assess and monitor third-party JavaScript, advertising, and tag-management content on consumer sites.
• Partner with developers on secure coding, OWASP risks, and remediation, and integrate security checks into CI/CD (SAST, dependency, and container scanning).

Cloud, container, and data platform security

• Secure AWS environments, including identity, logging, threat detection, and configuration baselines, and containerized workloads, including base-image hygiene and scanning.
• Help secure data platforms such as Snowflake, SQL Server, MongoDB, and data pipelines, with emphasis on access control and sensitive-data protection.

Network, remote access, and endpoint security

• Manage firewall, VPN, and remote-access security, including MFA, session policy, lockout standards, and threat-prevention content.
• Enforce device and endpoint standards (managed devices, EDR and antivirus coverage, patching) and close coverage gaps.

Identity and access management

• Drive least-privilege access, MFA, secrets management, privileged-access controls, and periodic access reviews across directory, cloud, and SaaS platforms.

Governance, risk, and compliance

• Maintain security policies and the policy-exception process, and apply policy to real decisions such as remote access, offboarding and equipment, and personal devices.
• Support SOC 2, PCI DSS, and privacy obligations with evidence, audit responses, and control improvements.
• Conduct vendor security reviews, and evaluate and help select security tools and services.

Communication and enablement

• Translate security risk into plain-language options and trade-offs for executives and engineering leaders, leaving decisions with the owners.
• Document decisions and changes in the ticketing system and keep a durable record of outcomes.
• Promote security awareness and build safe automation and AI-assisted tooling that extends the team’s reach.

Required Qualifications

• 5+ years in information security, with hands-on experience across at least three of: incident response, cloud security, application security, network security, vulnerability management.
• Experience leading security incidents from detection through root cause and reporting.
• Hands-on experience securing AWS and internet-facing web applications and APIs; working knowledge of OWASP risks.
• Experience with firewalls and VPN/remote-access security, and with endpoint protection (EDR/AV) and device management.
• Experience with WAF, bot management, DDoS protection, and CDN security.
• Strong log analysis skills across firewall, application, cloud, and identity sources.
• Working knowledge of IAM, MFA, encryption, and secrets management.
• Experience supporting SOC 2, PCI DSS, or similar compliance programs.
• Scripting and API skills (Python, PowerShell, or similar) for investigation and automation.
• Excellent written communication, including executive-level updates.
• Ability to prioritize by business impact and likelihood, and to explain that reasoning.

Preferred Qualifications

• Experience protecting high-traffic consumer sites from automated abuse and scraping (Cloudflare, DataDome, or similar).
• Experience with managed detection and response, SIEM, EDR, CSPM, SAST/DAST, and dependency or container scanning.
• Experience with containers and Kubernetes (EKS/ECR or similar).
• Familiarity with Snowflake, SQL Server, MongoDB, or large-scale data platforms.
• Familiarity with Java, JavaScript/Node.js, Angular, Python, or similar stacks.
• Knowledge of privacy requirements for consumer data, people-search, or data-broker businesses.
• Certifications such as CISSP, GIAC, AWS Security Specialty, PCNSE, or Security+, or equivalent practical experience.

What Success Looks Like

• Incidents are handled quickly and thoroughly, with clear ownership and documented root cause.
• New critical vulnerabilities get an exposure answer within a day, and remediation is tracked to completion within defined timelines.
• Automated abuse and scraping are detected and mitigated, and the controls are measured and tuned.
• Cloud, application, network, and endpoint controls are documented, measurable, and improving, with coverage gaps closing.
• Leadership receives timely, proportionate updates and can make decisions without chasing details.
• Engineering teams see security as a practical partner.

Other

Compensation range:

[to be set with HR; required in many US states for remote postings]

Background check:

Must pass a background check.

On-call:

[confirm whether the role participates in an on-call or after-hours incident rotation]

Benefits

• Flexible PTO
• 6% 401K match
• 100% of the cost paid for the employee for medical, dental and vision
• 75% of the cost paid for dependents for medical, dental and vision