IT Compliance & Vendor Management Lead — Remote

The Landline Company; New York (NY); Remote; USD 120,000 - 175,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) with company match

Disability and life insurance

Parental leave

Flight benefits with airline partners

Job summary

The Landline Company is building a revolutionary airport journey by decentralizing the airport and expanding travel beyond terminals. The Manager, IT Compliance & Vendor Management leads the cybersecurity control program and oversees the MSP delivering day-to-day IT operations.

You will design, operate, and evidence CSF 2.0 compliance while managing vendor relationships and security reviews. Remote in a major metro in the US/Canada with travel as needed; compensation ranges from 120,000 to

Qualifications

• Five+ years in IT compliance, information security, IT audit, or IT governance.
• Hands-on experience with recognized security frameworks (NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls).
• Experience administering or as primary user of a GRC/compliance automation platform (Vanta, Drata, Secureframe, LogicGate, AuditBoard, ServiceNow GRC).
• Experience managing or overseeing outsourced IT providers, including SLA monitoring and escalation.
• Knowledge of core IT controls: identity/access, endpoint, logging, vulnerability, backup, change management.
• Ability to critically read SOC 2 Type II reports, including scope and exceptions.
• Clear written communication for external audiences.
• Professional certifications such as CISA/CRISC/CISM/CISSP are a plus.
• NIST CSF 2.0 implementation experience, especially Govern and supply chain risk management.
• Transportation/regulated industry experience is a plus.
• Familiarity with PCI DSS, CCPA/CPRA, or breach notification requirements welcome.
• Experience building a compliance program from an early baseline is valued.
• ITIL or service management background is a plus.
• Contract negotiation experience with vendors or service providers a plus.

Responsibilities

• Maintain the control set mapped to NIST CSF 2.0 across Govern, Identify, Protect, Detect, Respond, Recover.
• Administer the Vanta/GRC platform including integrations, monitoring, evidence collection, tests, and remediation tracking.
• Perform periodic control testing and document results with owners and due dates.
• Own policy lifecycle: drafting, annual review, routing, publication, attestation tracking.
• Maintain enterprise risk register with scoring, treatment decisions, and exec reporting.
• Coordinate evidence for customer security reviews and external audits.
• Administer security awareness training program and phishing simulations.
• Serve as primary MSP relationship owner, manage escalations and service delivery.
• Monitor SLAs, document breaches, drive root-cause analysis and remedies.
• Chair quarterly MSP business reviews, set agenda, track commitments, maintain action log.
• Own MSP contract lifecycle: scope changes, renewals, pricing, exit/transition.
• Verify MSP-controlled measures with evidence rather than assertion.
• Govern MSP access management and periodic access certification.
• Maintain RACI for controls between MSP and Landline.
• Operate vendor intake and security review process for new tech.
• Maintain vendor inventory with classification and review cadence.
• Review third-party assurance artifacts (SOC 2 II, ISO 27001, pen tests).
• Track vendor security terms, breach obligations, DPAs.
• Maintain incident response plan and coordinate annual tabletop exercises.
• Act as compliance lead during security incidents and post-incident reporting.
• Maintain business continuity and disaster recovery docs; coordinate annual restoration testing.
• Deliver recurring compliance and vendor performance reports to exec leadership.
• Provide security/compliance input to procurement, legal, operations.
• Track and report program metrics.

Skills

IT compliance

Information security

SOC 2

Education

CISA

CRISC

CISM

CISSP

Tools

Vanta

Drata

Secureframe

LogicGate

AuditBoard

ServiceNow GRC

Job description

The Landline Company is building a revolutionary airport journey by decentralizing the airport and expanding travel beyond terminals. The Manager, IT Compliance & Vendor Management leads the cybersecurity control program and oversees the MSP delivering day-to-day IT operations.

You will design, operate, and evidence CSF 2.0 compliance while managing vendor relationships and security reviews. Remote in a major metro in the US/Canada with travel as needed; compensation ranges from 120,000 to