Security Governance Lead - SOC 2, ISO 27001, AI

Field Nation; Northern (KY); Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Unlimited paid time off

Annual vacation bonus

401K

Job summary

Field Nation is seeking a Security Governance & Compliance Manager to lead our governance, risk, and compliance programs including SOC 2 Type II, ISO 27001, and AI governance. You will manage policy, vendor risk, and third-party governance while building a distributed team across time zones.

You will partner with engineering on technical controls, handle auditor relationships, and communicate security posture to customers and executives.

Qualifications

• Led ISO 27001 implementation through to certification or built SOC 2 Type II program with credible gap analyses.
• Experience running a compliance/GRC program end-to-end with enterprise customers and handling customer security questionnaires.
• Ability to discuss technical controls with engineers and assess automation for true enforcement.

Responsibilities

• Own SOC 2 Type II program end-to-end: control operation, evidence, auditor liaison, and reporting.
• Lead ISO 27001 from scratch to certification, scope ISMS, remediate gaps, select auditor.
• Own AI governance across product and marketplace, manage AI inventory and risk register.
• Oversee policy, risk, and third-party governance, and manage customer security questionnaires.
• Set identity and access governance, design joiner/mover/leaver processes, ensure audit trails.
• Build and lead a distributed team, oversee two direct reports in Bangladesh.
• Define compliance automation strategy with a GRC engineer and validate controls.
• Participate in security escalation rotation with leadership.

Skills

ISO 27001 implementation

SOC 2 Type II

GRC program management

auditor liaison

security governance

Job description

Field Nation is seeking a Security Governance & Compliance Manager to lead our governance, risk, and compliance programs including SOC 2 Type II, ISO 27001, and AI governance. You will manage policy, vendor risk, and third-party governance while building a distributed team across time zones.

You will partner with engineering on technical controls, handle auditor relationships, and communicate security posture to customers and executives.