IT Operations & SOC 2 Lead

Polanov Tech; United States; Remote; CLP 44,309,000 - 63,106,000; Part time

Job summary

Polanov Tech seeks a Corporate IT Lead to own IT operations, security, and the SOC 2 program for a fully remote company with employees across the US, UK, South America, and Europe. You will connect customer expectations, commercial needs, and risk to design effective controls and remediation, working with MSPs and vendors in a senior IC role.

You’ll build a corporate IT roadmap, govern SaaS and endpoints, manage identity and access, and lead security responses.

Qualifications

• SOC 2 leadership and judgment.
• Direct auditor engagement.
• Corporate IT ownership with 5+ years experience.
• MSP and vendor oversight.
• Strong technical foundation in common enterprise tools.
• Clear communication of decisions to business teams.

Responsibilities

• Own SOC 2 program end-to-end, including scope, evidence, and remediation.
• Build and govern the corporate IT roadmap with leadership.
• Govern the SaaS portfolio, license management, and tool selection.
• Set MSP expectations and oversee global IT service delivery.
• Define IAM policies and respond to security incidents.

Skills

SOC 2 leadership

Auditor engagement

Corporate IT ownership

MSP oversight

Tech foundation

Clear communication

Tools

Microsoft 365

Entra ID

Windows endpoint management

macOS endpoint management

MDM

Job description

Corporate IT Lead — SOC 2 & IT Operations

Remote | Contractor | USD 40 per hour

Senior individual contributor | Reports to the SVP of Engineering

About the role

Our client is looking for a Corporate IT Lead to own corporate IT operations, security, and the SOC 2 program for a fully remote company with employees across the US, UK, South America, and continental Europe.

A central part of this role is understanding why the company pursues SOC 2. You’ll connect customer expectations, commercial commitments, and business risk to decisions about audit scope, control design, and remediation. You’ll be expected to explain why a control is needed, what risk it addresses, and how the company can sustain it in day-to-day operations.

This is a senior individual contributor role with no direct reports. Managed service providers (MSPs), contractors, and vendors handle much of the day-to-day work. You’ll set expectations, make decisions when trade-offs arise, and remain accountable for the quality, security, and reliability of the services they deliver.

What you’ll own

SOC 2 program and audit readiness

Own the SOC 2 program end to end, from defining scope and preparing for audits to coordinating control owners, overseeing evidence collection, and driving remediation. Translate customer expectations, commercial needs, and business risks into practical controls. Assess whether each control addresses the underlying risk and can operate consistently with the resources available. Serve as the primary contact for external auditors. Lead discussions about scope, controls, evidence, and findings, and explain how the company’s practices address the risks in scope. Assign clear control ownership and help teams understand how their responsibilities fit into everyday work. Prioritize remediation by risk and business impact, and explain material trade-offs to leadership.

Corporate IT strategy and systems governance

Build and maintain a corporate IT roadmap with the SVP of Engineering and other leaders. Recommend improvements that balance security, employee experience, cost, and maintainability. Govern the SaaS portfolio, including application inventory, ownership, access, licensing, renewals, and tool selection. Identify duplicate tools, weak integrations, and avoidable spend. Maintain visibility into key systems, integrations, data flows, and dependencies. Oversee the CRM administration contractor and provide technical direction for CRM and other business systems.

MSP management and IT service delivery

Own IT service delivery for a globally distributed workforce. Set service expectations, performance measures, and escalation paths for MSPs and contractors, and address recurring service gaps. Oversee onboarding, offboarding, hardware provisioning, access changes, external-user access, and remote support across US and UK/European working hours. Govern the Windows and macOS endpoint lifecycle, including inventory, configuration standards, security, patching, and replacement.

Identity, security, and information governance

Own identity and access management, including SSO, MFA, privileged access, and access changes as employees join, change roles, or leave. Lead the response to corporate IT security incidents, participate in broader incident response as needed, and own third-party technology and vendor security reviews. Define practical policies for information ownership, access, retention, sharing, and storage. Keep key systems, integrations, and administrative responsibilities documented so they can be transferred when needed. Govern the approved AI toolkit and usage policies. Evaluate AI tools, agents, and integrations for business value and data-handling risks, monitor adoption and spend, and coordinate employee training.

What you bring

• SOC 2 leadership and judgment. You’ve owned or substantially led an internal SOC 2 program and taken meaningful responsibility for decisions and outcomes. You can explain what the business needed from SOC 2, how that shaped the scope and controls, and what you did when a control was ineffective or impractical.
• Direct auditor engagement. You’ve led substantive conversations with external auditors about scope, controls, evidence, findings, or remediation and can coordinate control owners across technical and business teams.
• Corporate IT ownership. You have at least five years of relevant IT experience, including responsibility for corporate IT operations or a substantial part of the function in a lean organization. You can identify risks, evaluate options, and make recommendations independently.
• MSP and vendor oversight. You’ve defined service expectations, delegated operational work, and held providers accountable for delivery and security.
• Technical foundation. You have working knowledge of Microsoft 365, Entra ID, identity and access management, SaaS governance, and Windows and macOS endpoint management, including mobile device management (MDM).
• Clear communication. You can explain technical and compliance decisions in business terms and document them so other teams can act on them.

If your SOC 2 background is primarily in external auditing, evidence collection, or control implementation, be prepared to show where you exercised independent judgment, influenced program decisions, and took responsibility for the outcome.

Preferred experience

• Primary IT ownership in a small or midsize company, or substantial independent responsibility as a senior member of an IT function supporting roughly 100–500 employees.
• Experience supporting an international or fully remote workforce.
• Experience with ISO 27001 or a comparable security and compliance program.
• Familiarity with Microsoft Dynamics 365 or a comparable CRM, and with scripting, APIs, Microsoft Graph, PowerShell, or workflow automation.

What success looks like

Control owners understand what they’re accountable for and why. Controls address meaningful risks and operate throughout the year. Audit evidence is available on time, findings are prioritized by risk, and leadership gets early visibility into decisions that affect customers or the business. Employees receive reliable IT support, and service providers meet clear expectations.

Working model

This is a remote contractor engagement at USD 40 per hour. The role requires flexibility to collaborate across US and UK/European working hours, including occasional earlier starts depending on location. Expect approximately one to two trips to the UK per year for company gatherings, planning, or IT-related work.