Security & Compliance Lead — Build a Secure Startup Program

Opal; San Francisco (CA); On-site; USD 150,000 - 190,000; Full time

Job summary

Opal Security in San Francisco is seeking a Security Manager to own our internal security program, including operations, risk, and vendor oversight. This hands-on role collaborates with engineering, operations, and leadership to keep our startup secure while moving fast.

You will supervise IT operations via our MSP, oversee SOC 2 readiness, incident response, bug bounty coordination, and remediation tracking, with 3+ days in the office in downtown San Francisco.

Qualifications

• 5+ years of experience in security operations, GRC, IT security, or similar security-focused role.
• Experience owning or driving a company security program.
• Familiarity with SOC 2; FedRAMP, ISO 27001, or similar frameworks a plus.
• Experience with incident response, endpoint security, access reviews, logging/monitoring, and remediation tracking.
• Strong understanding of identity and access concepts: SSO, MFA, least privilege, access reviews, joiner/mover/leaver processes.
• Experience managing security vendors, consultants, auditors, or other external partners.
• Comfort managing IT operations through an MSP or similar external provider.
• Strong written and verbal communication skills.
• Ability to operate independently, prioritize risk, and drive cross-functional follow-through in a startup environment.

Responsibilities

• Own Opal's internal security program across people, systems, devices, vendors, and office environments.
• Manage security tooling for endpoint protection, SSO, MFA, access reviews, logging, monitoring, and alerting.
• Lead security incident response, including triage, investigation, remediation, communications, and follow-up.
• Run internal access reviews and improve least-privilege practices across company systems.
• Manage physical and digital access controls for the office and internal tools.
• Drive SOC 2 compliance work, including control ownership, evidence collection, audit readiness, and auditor coordination.
• Maintain security policies, procedures, exceptions, control documentation, and audit evidence.
• Track security risks and drive practical remediation based on business impact.

Skills

Security operations

GRC program ownership

SOC 2 familiarity

Incident response

Identity & access

Vendor management

MSP IT operations

Communication skills

Startup risk governance

Job description

Opal Security in San Francisco is seeking a Security Manager to own our internal security program, including operations, risk, and vendor oversight. This hands-on role collaborates with engineering, operations, and leadership to keep our startup secure while moving fast.

You will supervise IT operations via our MSP, oversee SOC 2 readiness, incident response, bug bounty coordination, and remediation tracking, with 3+ days in the office in downtown San Francisco.