InfoSec Program Lead - Scalable, Audit-Ready Security

Plume Design; United States; Hybrid; USD 160,000 - 230,000; Full time

Benefits offered by this job

Health insurance

Remote/flexible work arrangements

Home-office setup allowance

Professional development opportunities

Team-building events

Job summary

Plume Design is seeking a Senior Manager of Information Security to lead the security program at a pivotal growth stage. You will own ISO 27001 and SOC 2 alignment, formalize policies, and drive a high-performing security team while enabling engineers to move fast.

You will own risk management, incident response, and security architecture across AWS/GCP, networks, and applications, delivering a proactive, audit-ready program with measurable impact.

Qualifications

• Bachelor’s degree in Information Security or related field, or equivalent work experience.

Responsibilities

• Own and mature the information security program aligned with ISO 27001 and SOC 2 requirements.
• Lead, coach, and develop a security team to build a durable security program.
• Translate security risk into business terms for leadership and the board.
• Manage external auditors, pen testers, and compliance vendors.
• Protect infrastructure, networks, cloud environments, and applications end-to-end.
• Establish secure SDLC practices including threat modeling and secure code review.

Skills

Security leadership

Risk management

Audits & compliance

Cloud security (AWS/GCP)

Threat modeling

Security architecture

Incident response

Education

Bachelor's degree in Information Security

Bachelor's degree in Computer Science

Related field or experience

Tools

AWS

GCP

Kubernetes

CI/CD tooling

Job description

Plume Design is seeking a Senior Manager of Information Security to lead the security program at a pivotal growth stage. You will own ISO 27001 and SOC 2 alignment, formalize policies, and drive a high-performing security team while enabling engineers to move fast.

You will own risk management, incident response, and security architecture across AWS/GCP, networks, and applications, delivering a proactive, audit-ready program with measurable impact.