Security & Compliance Manager

relocity; Stati Uniti; Remoto; USD 140.000 - 170.000; Tempo pieno

Vantaggi offerti da questo lavoro

Remote workplace with flexible work

Bonus potential

401(k) plan

Professional development opportunities

Health, dental, vision, and long-term/

Descrizione del lavoro

relocity is seeking a Security & Compliance Manager to own an established information security, privacy, and data governance program in a cloud-first setting. You will partner with engineering, product, operations, legal, and admin to ensure systems and policies meet evolving regulatory and security requirements.

The role focuses on leading SOC 2 Type II and ISO 27001 efforts, managing privacy regulations like GDPR/CCPA, and driving risk assessments, remediation, and governance across the

Competenze

• 3–5 years of experience in information security, data privacy, governance, compliance, or risk management.
• Direct experience maintaining SOC 2 Type II and leading or supporting ISO 27001 certification in SaaS/cloud-first environments.
• Hands-on experience with Vanta or comparable GRC platforms (Drata, Secureframe, Sprinto).
• Working knowledge of GDPR, CCPA, and other privacy regulations.

Mansioni

• Maintain SOC 2 Type II compliance, including day-to-day control operation, evidence collection, and annual audit readiness.
• Lead ISO 27001 certification from gap assessment through certification and ongoing surveillance audits.
• Advise leadership on security, privacy, and compliance matters and oversee GDPR/CCPA compliance.
• Conduct security risk assessments, manage incident response, and drive remediation across the business.
• Define enterprise data governance standards, including data classification, retention, and lifecycle management.
• Administer Vanta and related GRC tooling to automate compliance monitoring, continuous control testing, and audit workflows.
• Lead company-wide security awareness initiatives and monitor evolving threats and industry best practices.

Conoscenze

Security governance

Regulatory compliance

Cross-functional collaboration

Communication skills

Formazione

Bachelor's degree in Information Security or related field

Strumenti

Vanta

Drata

Secureframe

Sprinto

Descrizione del lavoro

Role overview

The Security & Compliance Manager takes ownership of an established information security, privacy, and data governance program within a cloud-first organization. Reporting to senior leadership, the role partners with engineering, product, operations, legal, and administrative functions to keep systems, processes, and policies aligned with evolving regulatory and security requirements.

Responsibilities

• Maintain SOC 2 Type II compliance, including day-to-day control operation, evidence collection, and annual audit readiness.
• Lead the ISO 27001 certification effort from gap assessment through certification and ongoing surveillance audits.
• Advise leadership as the primary strategist on security, privacy, and compliance matters, and oversee additional frameworks such as GDPR and CCPA.
• Conduct security risk assessments, manage incident response processes, and drive remediation across the business.
• Define enterprise data governance standards, including data classification, retention, and lifecycle management.
• Administer Vanta and related GRC tooling to automate compliance monitoring, continuous control testing, and audit workflows.
• Lead company-wide security awareness initiatives and monitor emerging threats, regulations, and industry best practices.

Requirements

• Three to five years of experience in information security, data privacy, governance, compliance, or risk management.
• Direct experience maintaining SOC 2 Type II and leading or supporting an ISO 27001 certification in a SaaS or cloud-first environment.
• Hands-on experience with Vanta or a comparable GRC platform such as Drata, Secureframe, or Sprinto.
• Working knowledge of GDPR, CCPA, and other applicable privacy regulations.
• Familiarity with cloud infrastructure, SaaS environments, identity and access management, and core security controls.
• Strong communication skills with the ability to explain technical concepts to non-technical audiences and influence cross-functional stakeholders.
• Bachelor's degree in Information Security, Computer Science, Information Systems, Business, Legal Studies, or a related field, or equivalent practical experience.

Nice to have

• Professional certifications such as CIPP/US, CIPM, CISSP, CISM, or CRISC.
• Experience in a high-growth SaaS or technology startup environment.
• Knowledge of privacy-by-design principles.

Benefits and work setup

• Remote workplace with flexible work schedules.
• Competitive compensation with a salary range of $140,000 to $170,000 plus bonus.
• Paid time off and paid parental leave.
• Health, dental, vision, and long-term disability insurance.
• 401(k) plan and professional development opportunities.