Information Security Manager

PowerPlan; Atlanta (GA); Hybrid; USD 120,000 - 160,000; Full time

Job summary

PowerPlan is seeking a versatile Information Security & Compliance professional to own governance, audits, and risk in a small team. You’ll manage SOC 1/2 attestations, policy governance, and vendor risk, collaborating with engineering, IT, and the business to protect our SaaS platform used by large utilities.

You’ll work closely with the VP and mentor a junior teammate, helping shape how the team grows. This hybrid role combines onsite collaboration with remote work flexibility.

Qualifications

• Experience in SaaS and cloud environments to discuss risk with engineers.
• Facilitated audits such as SOC 2, ISO 27001 or NIST CSF.
• Eight+ years in cybersecurity compliance, audit or risk management.
• Able to explain risk to engineers and executives.
• Wears many hats with governance and risk expertise.

Responsibilities

• Facilitate SOC 1 and SOC 2 attestations from scoping through fieldwork.
• Own information security policy governance with clear owners.
• Run enterprise security risk program with defined owners and plans.
• Manage vendor risk assessments and select GRC tooling.
• Report program health to leadership and mentor a junior teammate.

Skills

SaaS experience

SOC 2 audits

ISO 27001

NIST CSF

Risk management

Cloud environments

Engineer communication

Tools

Drata

Vanta

Full Circle

UpGuard

Job description

Overview

This role is for someone who likes doing a lot of different things well. Our Information Security & Compliance team is small, so governance, audit, and risk aren’t separate lanes here. You’ll work across policy management, SOC 2 and other audits, risk management, and vendor risk, and you’ll see how all of it connects, which is experience you won’t get in a role that covers only one piece.

You’ll be the right hand to our VP of Information Security & Compliance, with a real path to grow into broader security leadership. You’ll own the compliance process day to day, work hands-on across audits, policy, and risk, mentor a junior teammate, and talk through risks with engineering, IT, and the business. Our customers are large utilities and energy companies that run billions in regulated assets on our SaaS platform, so they ask hard questions about how we protect it, and you’ll help us answer them.

Responsibilities

Success will be measured by audits that go smoothly, policies and risks that are well managed, and leadership that always knows where we stand. Audits, policy, and risk management are the heart of the job. That looks like:

• Facilitating our SOC 1 and SOC 2 attestations and other external audits from scoping through fieldwork, so evidence arrives on time and audit readiness is a year-round habit, not a scramble.
• Owning information security policy governance, with clear owners, a steady review cadence, and records an auditor can follow.
• Running our enterprise security risk program, and explaining why each risk matters in plain security and SaaS terms, so every risk has an owner, a plan, and a date.
• Managing vendor risk assessments and helping choose and set up the GRC tooling (think Drata, Vanta, Full Circle, or UpGuard) that makes the whole team more effective.
• Reporting program health to leadership and partnering with CloudOps, IT, and Dev, while supporting security awareness training, customer questionnaires, and incident response.
• Mentoring a junior teammate along the way and helping shape how the team grows.

Qualifications

• You’ve worked in the SaaS industry and understand software and cloud environments well enough to talk through risk with engineers.
• You’ve facilitated audits such as SOC 2, ISO 27001, or NIST CSF 2.0 (FedRAMP experience counts too).
• You have eight or more years in cybersecurity compliance, audit, or risk management.
• You can talk across security domains and explain why a risk matters to an engineer or an executive.
• You like wearing a lot of hats. Maybe you started in a smaller organization and covered it all, or you’ve built deep governance expertise somewhere larger. Either path works.

PowerPlan is an EOE

Applicant Privacy Notice

Please note that this is a hybrid role that involves a combination of onsite work from our corporate office as well as work from home. While we strive to accommodate flexible working arrangements when sensible, there will be times when onsite work is required. This could include scheduled office days, team meetings, client meetings, or special events.