Security Operations Lead - SOC2, Vendor Risk, SF Office

Opal Security; San Francisco (CA); On-site; USD 120,000 - 200,000; Full time

Job summary

Opal Security in San Francisco is seeking a Security Manager to own Opal's internal security program. This hands-on role covers security operations, compliance posture, vendor risk, incident response, and security tooling, working with engineering, operations, and leadership.

The role emphasizes independence in a fast-moving startup, coordinating security intake, bug bounty operations, vulnerability management, and remediation tracking, with 3+ days in the office.

Qualifications

• 5+ years in security operations, GRC, IT security, or similar role.
• Experience owning or driving a security program.
• Familiarity with SOC 2; other frameworks are a plus.
• Incident response, endpoint security, access reviews, logging/monitoring, remediation tracking.
• Strong IAM knowledge: SSO, MFA, least privilege, joiner/mover/leaver.

Responsibilities

• Own Opal's internal security program across people, systems, devices, vendors, and office environments.
• Manage security tooling for endpoint protection, SSO, MFA, access reviews, logging, monitoring, and alerting.
• Lead security incident response, triage, investigation, remediation, communications.
• Run internal access reviews and improve least-privilege practices.
• Coordinate security intake, bug bounty operations, vulnerability management, and remediation tracking.

Skills

Security operations

GRC

SOC 2 familiarity

Incident response

Identity & access

Vendor management

IT MSP coordination

Communication skills

Job description

Opal Security in San Francisco is seeking a Security Manager to own Opal's internal security program. This hands-on role covers security operations, compliance posture, vendor risk, incident response, and security tooling, working with engineering, operations, and leadership.

The role emphasizes independence in a fast-moving startup, coordinating security intake, bug bounty operations, vulnerability management, and remediation tracking, with 3+ days in the office.