Remote IT Compliance & Vendor Management Lead

The Landline Company; Oregon; Hybrid; USD 120,000 - 175,000; Full time

Benefits offered by this job

Flight benefits with airline partners

Comprehensive benefits

Discretionary PTO

Job summary

The Landline Company is seeking a Manager, IT Compliance & Vendor Management to build and run its cybersecurity control program and oversee the MSP delivering day-to-day IT operations. The role spans MSP performance and evidencing of the control program against CSF 2.0, within a regulated transportation environment with airline and airport partners.

Remote work is possible in a major metro area in the US or Canada, with travel as needed.

Qualifications

• Five or more years in IT compliance, information security, IT audit, or IT governance, including at least two years with direct responsibility for a control program or audit function.
• Hands-on experience implementing or operating a recognized security framework (NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls, or equivalent)
• Experience administering or serving as a primary user of a GRC or compliance automation platform (Vanta, Drata, Secureframe, LogicGate, AuditBoard, ServiceNow GRC, or equivalent)
• Experience managing or formally overseeing an outsourced IT provider, including service level monitoring and escalation
• Working knowledge of core IT controls: identity and access management, endpoint management, logging and monitoring, vulnerability management, backup and recovery, and change management
• Ability to read a SOC 2 Type II or similar report critically, including scope boundaries, exceptions, carve-outs, and complementary user entity controls
• Clear written communication, as this role produces documentation that external parties read and rely on

Responsibilities

• Maintain the company's control set mapped to NIST CSF 2.0 across all six Functions: Govern, Identify, Protect, Detect, Respond, and Recover
• Administer the Vanta GRC platform, including integrations, control monitoring, evidence collection, automated test configuration, and remediation tracking
• Perform periodic control testing and design effectiveness reviews, document results, and drive remediation to closure with named owners and due dates
• Own the policy lifecycle: drafting, annual review, approval routing, publication, and attestation tracking
• Maintain the enterprise risk register, including risk scoring methodology, treatment decisions, and executive reporting
• Prepare and coordinate evidence for customer security reviews, airline partner assessments, insurance questionnaires, and external audits or assessments
• Administer the security awareness training program, including phishing simulation and completion tracking
• Serve as the primary relationship owner for the MSP, managing escalations, scheduling, and day-to-day service delivery expectations
• Monitor and report on contracted service levels, document breaches, drive root-cause analysis, and enforce contractual remedies where warranted
• Chair quarterly business reviews with the MSP, setting the agenda, tracking commitments, and maintaining a running action log
• Own the MSP contract lifecycle, including scope changes, renewals, pricing negotiation, and the exit and transition plan
• Verify that MSP-operated controls function as contracted, requiring evidence rather than assertion
• Govern access administration performed by the MSP, including joiner/mover/leaver execution, privileged access review, and periodic user access certification
• Maintain the responsibility assignment matrix (RACI) that defines which controls the MSP operates, which Landline operates, and which are shared
• Operate the vendor intake and security review process for new technology purchases
• Maintain the vendor inventory with data classification, criticality tiering, and review cadence
• Collect and review third-party assurance artifacts (SOC 2 Type II reports, ISO 27001 certificates, penetration test summaries), including analysis of complementary user entity controls and any qualified opinions
• Track vendor contract security terms, breach notification obligations, and data processing agreements
• Maintain the incident response plan and coordinate the annual tabletop exercise
• Serve as compliance lead during security incidents, covering evidence preservation, regulatory notification analysis, and post-incident reporting
• Maintain business continuity and disaster recovery documentation, and coordinate annual restoration testing with the MSP
• Deliver a recurring compliance and vendor performance report to executive leadership
• Provide security and compliance input to procurement, legal, and operations
• Track and report program metrics

Skills

IT compliance

Information security

IT audit

IT governance

GRC platforms

Vendor management

SOC 2 Type II

NIST CSF 2.0

Security frameworks

Contract negotiation

Tools

Vanta

Drata

Secureframe

LogicGate

AuditBoard

ServiceNow GRC

Job description

The Landline Company is seeking a Manager, IT Compliance & Vendor Management to build and run its cybersecurity control program and oversee the MSP delivering day-to-day IT operations. The role spans MSP performance and evidencing of the control program against CSF 2.0, within a regulated transportation environment with airline and airport partners.

Remote work is possible in a major metro area in the US or Canada, with travel as needed.