Security & Compliance Lead

Archlet; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

Archlet is seeking a security and compliance leader to own the daily execution of security, privacy, and audits. You will work directly with the CTO/CISO to drive ISO 27001 readiness, coordinate SOC 2 Type II programs, and extend our Vanta setup with proper documentation and evidence.

You’ll partner with engineering on cloud security, data governance, vendor risk, and AI governance, while communicating clearly with customers and leaders in English.

Qualifications

• 5+ years in information security, security compliance, or GRC with substantial SaaS/cloud responsibilities.
• Independently managed ISO 27001 audit cycles and delivered SOC 2 Type II results.
• Deep understanding of cloud architecture, authentication/authorization, least privilege, logging, and vulnerabilities.
• Experience with GDPR compliance, DPAs, privacy assessments, and vendor risk.
• Excellent written and spoken English with stakeholder management skills.

Responsibilities

• Own daily security/compliance execution with CTO/CISO; balance audits, customer requests, and improvements.
• Lead SOC 2 Type II project lifecycle and ongoing program.
• Be first point of contact for security/compliance questions across the company and with customers.
• Maintain risk registers and subprocessor information; drive GDPR compliance.
• Coordinate annual penetration testing and remediation with engineering teams.
• Collaborate on cloud security, access reviews, and security configurations across products.
• Create practical security trainings and automate evidence collection and reviews.

Skills

Security governance

ISO 27001

SOC 2

Cloud security

Vendor risk

Audit readiness

Customer communication

Program management

Education

Bachelor's in CS/IS

Tools

Azure

Entra ID

Intune

Microsoft Defender

Vanta

Job description

What we are looking for

You have an engineering background, understand our technical setup, and can proactively shape our security posture. In our fast-growing scale-up, you’ll take on a wide variety of tasks, with real ownership and room to be creative. Your pragmatic, can-do mindset helps you find solutions that let Archlet move fast while staying secure and compliant. You're a great team player who loves software engineering and wants to help Archlet grow.

Your mission

Working directly with our CTO/CISO, you’ll own the daily execution of security and compliance at Archlet. Your priorities will shift between customer requests, audits, and security improvements, giving you broad responsibility and visible impact.

• Keep Archlet secure and audit-ready. Own our ISO 27001 compliance program, maintain policies and evidence in Vanta, coordinate internal and external audits, and ensure control owners complete their responsibilities and corrective actions.
• Lead our first SOC 2 Type II program in 2027. Build and execute the plan, select and manage the auditor, extend our existing controls and Vanta setup, and coordinate evidence collection through the examination period and final report. Own the recurring program afterward.
• Help customers confidently choose Archlet. Be the first point of contact for security and compliance questions across the company. Complete customer assessments, explain our safeguards clearly, and maintain our Trust Center and reusable answers to make future requests faster.
• Turn security, privacy, and AI risks into action. Maintain our risk registers, assess vendors, and keep subprocessor information current. Drive operational GDPR compliance and maintain documents such as DPAs, privacy assessments, and AI governance records, involving legal specialists when needed.
• Lead penetration testing and security remediation. Coordinate our annual independent pentest from scope and preparation through findings review, engineering tickets, retesting, and customer-facing reports. Work with engineering to prioritize findings and confirm that remediation addresses the underlying risk.
• Improve security across our product and workplace. Partner with Platform and Application Engineering on cloud security, identity, secure development, and security validation of new features. Run access reviews, manage security‑tool findings and routine security configurations, and coordinate recovery tests and incident‑response preparation.
• Make secure working easier and more efficient. Deliver practical employee and engineering training, run phishing exercises, and improve how we work through automation and thoughtful use of AI - for example, accelerating questionnaires, collecting evidence, and supporting security reviews.

About you

• Experience owning delivery. Typically 5+ years in information security, security compliance, or GRC, with substantial responsibility in a SaaS or cloud-based software environment. You have personally operated programs and closed gaps, with results beyond recommendations and audit reports.
• Strong ISO 27001 and proven SOC 2 experience. Youhave independently managed an ISO 27001 audit cycle and held substantial delivery responsibility for a completed SOC 2 Type II cycle. You understand control design, operating evidence, auditor expectations, and remediation. Leading a first-time SOC 2 program is particularly valuable.
• Technical depth to work effectively with engineers. You understand cloud architecture, authentication and authorization, least privilege, endpoint protection, logging, and common application vulnerabilities. You can assess findings, challenge proposed solutions constructively, and agree on evidence that demonstrates a fix. Writing application code or opening PRs is not required.
• Practical privacy and risk-management skills. You have handled vendor assessments, risk registers, and operational GDPR requirements, including data processing agreements, retention, and international transfers. You can resolve routine questions independently and recognize when specialist legal advice is needed.
• Clear communication with customers and colleagues. Youhave completed enterprise security questionnaires and can explain technical safeguards accurately in excellent written and spoken English. You distinguish existing capabilities from planned improvements and avoid making unsupported commitments.
• Reliable execution across teams. You organize competing requests, manage external providers, follow up with contributors, and drive work through to completion. You make sensible tradeoffs and elevate material risks or capacity conflicts early.
• An adaptable, practical approach. Youenjoy both detailed recurring work and new security challenges. You are comfortable switching from a lengthy questionnaire to audit preparation or an engineering discussion, and you actively improve processes that create unnecessary work.
• Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance is valuable. ISO 42001 experience is a bonus for potential future work.

Why Archlet?

We have a strong, international team of people with experience both in large enterprises like Google and Microsoft, but also experience in founding and growing tech startups. We push each other to higher degrees of product and engineering excellence, while looking at everything we do with a business mindset.
You'll have the autonomy to drive design decisions and make a real impact, with little bureaucracy and meetings, all within a supportive and innovative environment. We foster a culture of creativity and collaboration, with regular team activities, both virtual and in person.
Archlet is on a healthy growth trajectory, already has renowned customers like Walmart and PepsiCo, and has an exciting product roadmap that needs you to succeed.

About us

We are Archlet. We build an all in one, AI native sourcing platform that automates sourcing, brings structure and transparency to complex projects, and helps teams work faster and unlock more savings across all areas of spend. We value ownership, trust, and clear communication, give people the freedom to shape how things are done, and believe great products are built by teams who enjoy working together and taking responsibility.