Security Program Manager (ISO 27001 & SOC 2) — GRC Lead

Flexhire; United States; On-site; USD 140,000 - 190,000; Full time

Job summary

TinyFish is hiring a Senior Security Program Manager to run security and compliance as a program. You will own the operational backbone — audits, evidence collection, policy lifecycle, vendor risk, and customer security reviews — enabling the Security Lead to focus on architecture and threat work.

This IC role reports to the Staff Program Manager and is the first dedicated security program owner in the org, aligning enterprise deals with security requirements.

Qualifications

• 4-7 years in security or GRC program management, ideally in B2B SaaS.
• Experience running ISO 27001 and SOC 2 audits end-to-end, including auditor management.
• Fluency with Vanta (or Drata/Tugboat) and ability to compensate manually where needed.
• Comfort presenting to customer security teams and instilling confidence in the program.
• Strong written communication and sound judgment on control gaps.
• Ability to escalate issues quickly to the right audiences.

Responsibilities

• Compliance lifecycle: maintain ISO 27001, prep for SOC 2 Type 1 & 2, manage auditors, collect evidence in Vanta.
• Vulnerability management: own SLA dashboard, breach escalation, exception tracking; ensure timely fixes.
• Policy lifecycle: annual reviews, policy updates, training rollout, attestation tracking.
• People-ops security controls: onboarding/offboarding evidence, access reviews, training, background checks.
• Vendor risk: inventory, pre-procurement assessments, re-assessments, DPA tracking.
• Customer-facing security: questionnaires, CAIQs, RFPs, security calls; named SPM in trust center.
• Policy update cadence for terms and privacy; cross-functional collaboration.
• Risk and incident program ownership: maintain risk register, run quarterly reviews, run tabletop exercises.

Skills

Security program management

ISO 27001 / SOC 2

Vendor risk management

Security audits & evidence collection

Policy lifecycle & controls

Customer security reviews

Tools

Vanta

Drata

Tugboat

Job description

TinyFish is hiring a Senior Security Program Manager to run security and compliance as a program. You will own the operational backbone — audits, evidence collection, policy lifecycle, vendor risk, and customer security reviews — enabling the Security Lead to focus on architecture and threat work.

This IC role reports to the Staff Program Manager and is the first dedicated security program owner in the org, aligning enterprise deals with security requirements.