Senior Security Program Lead: ISO 27001 & SOC 2

Plume; United States; On-site; USD 180,000 - 240,000; Full time

Job summary

Plume is seeking a Senior Manager of Information Security to mature and run a hands-on security program. You will formalize policies, build a high-functioning team, and safeguard our infrastructure, cloud environments, and applications while enabling engineers to move quickly.

You will lead security across governance, engineering, and product, translating risk into business actions and guiding compliance with ISO 27001 and SOC 2 requirements.

Qualifications

• Bachelor's degree in Information Security, CS, or related field or equivalent work experience.
• 6-8+ years in information security, with 3+ years in a leadership role owning a security program end-to-end.
• Direct experience operating within ISO 27001 and SOC 2 frameworks — audit-ready mindset.
• Strong technical depth in cloud security (AWS/GCP), network security, and modern AppSec concepts.
• Experience building or rebuilding policies and procedures in a scaling SaaS environment.
• A track record of leading security teams that engineers actually enjoy working with.

Responsibilities

• Own and mature the information security program, ensuring full alignment with ISO 27001 and SOC 2 requirements, including the transition to SOC 2 Type 2.
• Author, formalize, and maintain the policies, standards, and procedures required to close gaps and sustain certification readiness.
• Run the internal control environment: risk assessments, control testing, audit evidence collection, and remediation tracking.
• Manage relationships with external auditors, pen testers, and compliance partners.
• Own the security of infrastructure, networks, cloud environments (AWS/GCP), and applications end to end.
• Set the strategy and roadmap for identity and access management, network and cloud security architecture, endpoint protection, vulnerability management, logging/monitoring, and incident response.
• Establish and continuously improve secure SDLC practices — threat modeling, secure code review, dependency and supply-chain security, CI/CD pipeline security.
• Own incident response: build the plan, run tabletop exercises, and lead the response when needed.
• Lead, coach, and develop security team — establishing clear roles, workflows, and a sense of ownership.
• Build a team culture rooted in partnership rather than gatekeeping: security as an enabler engineers want to work with, not a blocker they route around.
• Define how the team engages with Engineering and Product to minimize friction and rework.

Skills

Security leadership

Risk management

Cloud security

ISO 27001 SOC2

Policy development

Communication

Education

Bachelor's degree in Information Security or related field

Job description

Plume is seeking a Senior Manager of Information Security to mature and run a hands-on security program. You will formalize policies, build a high-functioning team, and safeguard our infrastructure, cloud environments, and applications while enabling engineers to move quickly.

You will lead security across governance, engineering, and product, translating risk into business actions and guiding compliance with ISO 27001 and SOC 2 requirements.