Security & Compliance Leader for SaaS & Privacy

Code and Theory; New York (NY); On-site; USD 140,000 - 175,000; Full time

Job summary

Code and Theory is seeking an Associate Director, Security & Compliance to lead security, privacy, and compliance for our SaaS products and client projects. You will own this capability end to end, from new business through implementation, certification, and ongoing monitoring.

You will drive SOC 2 Type II and ISO 27001 readiness, manage ISMS and AI governance, and coordinate auditor activities while partnering with delivery teams to embed security and privacy into our work.

Qualifications

• 8+ years of progressive experience in information security, including leadership in SaaS and/or professional services environments.
• Strong understanding of modern application and cloud security fundamentals (identity and access, encryption and key management, logging and monitoring, vulnerability management).
• Demonstrated ownership of SOC 2 Type II and ISO 27001 programs from readiness through steady-state operations.
• Strong working knowledge of privacy requirements and practices, including HIPAA, GDPR, and CCPA/CPRA, and experience operationalizing privacy controls in product and client delivery contexts.
• Experience building security and privacy processes that work in real delivery environments.
• Clear communication skills, able to represent security and privacy with internal teams, auditors, and client stakeholders with differing levels of technical fluency.

Responsibilities

• Lead our security program across SaaS products and client projects, setting strategy, priorities, and measurable outcomes.
• Lead SOC 2 Type II, ISO 27001, and ISO 42001 readiness and ongoing compliance, including control design, evidence processes, and auditor coordination.
• Own ISMS and AI governance documentation and oversight.
• Lead privacy governance and operational practices, ensuring compliance with applicable requirements including HIPAA, GDPR, and CCPA/CPRA, and addressing data handling, contractual privacy terms, and privacy by design expectations.
• Partner with delivery teams to embed security and privacy into how we build, with clear expectations, practical review gates, and patterns for common risks (identity, access, data handling, multi-tenancy, logging, and auditability).
• Establish a repeatable client engagement security plan for client work (environment segregation, access provisioning and deprovisioning, client data handling, incident coordination, and delivery requirements).
• Lead vendor security reviews, including due diligence for critical providers, remediation tracking, and ongoing monitoring.
• Support customer assurance efforts including security questionnaires, RFPs, client security reviews, and maintaining trust artifacts and standard responses.
• Maintain an incident response program (playbooks, escalation, exercises) and drive post‑incident improvements.
• Build a security and privacy culture through clear guidance, lightweight training, and day‑to‑day partnership with teams.

Skills

Security program leadership

SOC 2 Type II readiness

ISO 27001 readiness

Privacy governance

HIPAA/GDPR/CPRA knowledge

Communication with auditors

Cross-functional collaboration

Tools

Security tooling (CI/CD)

Threat modeling

Job description

Code and Theory is seeking an Associate Director, Security & Compliance to lead security, privacy, and compliance for our SaaS products and client projects. You will own this capability end to end, from new business through implementation, certification, and ongoing monitoring.

You will drive SOC 2 Type II and ISO 27001 readiness, manage ISMS and AI governance, and coordinate auditor activities while partnering with delivery teams to embed security and privacy into our work.