Information Security & Compliance Manager

We are seeking an Information Security & Compliance Manager to establish, operate, and continually improve our Information Security Management System (ISMS) and security compliance program. The role will lead our readiness and ongoing compliance for ISO/IEC 27001:2022 certification and SOC 2 reporting.

The successful candidate will translate security and compliance requirements into practical processes for a growing IT organization, coordinate technical and business teams, maintain audit-ready evidence, manage security risks and incidents, and report security performance to senior management.

• Establish, maintain, and improve the company's ISMS in line with ISO/IEC 27001:2022.
• Define and maintain the ISMS scope, information-security objectives, interested-party requirements, Statement of Applicability (SoA), risk-treatment plan, and compliance obligations register.
• Draft, maintain, communicate, and periodically review security policies, standards, procedures, and records.
• Ensure policies and procedures are practical for the company's actual working model, including remote work, cloud services, software development, support operations, and customer-data handling.
• Maintain a clear RACI/responsibility matrix for security controls, including control owners, evidence owners, approvers, reviewers, and escalation paths.
• Organize management-review meetings, prepare security metrics and risk reports, record decisions, and track actions to closure.
• Coordinate internal audits, external certification audits, SOC 2 readiness assessments, and SOC 2 examinations.

• Lead SOC 2 readiness and maintain compliance with the applicable Trust Services Criteria.
• Work with management and the auditor to determine the appropriate SOC 2 scope—normally Security first, with Availability, Confidentiality, Processing Integrity, and/or Privacy included only where required by customers and services.
• Maintain a control matrix mapping SOC 2 requirements to company policies, processes, technical configurations, control owners, and evidence.
• Create and manage an evidence calendar covering monthly, quarterly, annual, and event-driven controls.
• Collect, validate, organize, and retain audit evidence, such as access-review records, onboarding/offboarding records, change approvals, vulnerability reports, training completion, incident records, backup-testing results, supplier reviews, and management-review minutes.
• Coordinate with external auditors and respond to audit queries, exceptions, corrective actions, and remediation requests.
• Ensure evidence proves that controls operated consistently throughout the SOC 2 audit period, especially for a Type II report.

SOC 2 readiness typically requires demonstrable evidence around risk assessment, access controls, monitoring, incident response, vendor management, change management, and security awareness—not merely written policies.

• Establish and manage the information-security risk-assessment methodology, risk register, treatment plans, risk owners, due dates, and risk-acceptance process.
• Conduct periodic and change-triggered risk assessments for systems, products, projects, new vendors, cloud services, and material changes.
• Track legal, contractual, and customer security requirements relevant to the business.
• Identify control gaps, assess impact and likelihood, recommend treatment options, and escalate overdue or high risks to leadership.
• Monitor compliance with security policies and coordinate corrective and preventive actions.

• Partner with IT, DevOps, engineering, HR, and operations teams to implement and monitor security controls.
• Oversee identity and access management, including least privilege, MFA, privileged-access controls, joiner-mover-leaver processes, and periodic access reviews.
• Coordinate vulnerability management, patching, endpoint protection, secure configuration baselines, log monitoring, and remediation tracking.
• Review cloud and SaaS security configurations, including AWS/Azure/GCP, Microsoft 365/Google Workspace, source-code repositories, ticketing systems, CRM, and backup platforms, as applicable.
• Ensure secure development and change-management practices are documented and followed, including code review, testing, deployment approval, and emergency-change processes.
• Review backup, disaster-recovery, and business-continuity arrangements; coordinate periodic tests and document outcomes.
• The role may oversee these activities but does not need to personally administer every platform. Technical system owners should execute relevant controls and provide evidence.

• Maintain and test the incident-response plan, incident-severity model, internal escalation process, and customer-notification process.
• Coordinate security incident investigation, containment, recovery, post-incident review, root-cause analysis, and improvement actions.
• Maintain the incident register and ensure lessons learned are converted into tracked improvements.
• Develop and deliver security-awareness training for employees, contractors, and relevant third parties.
• Conduct onboarding security briefings and periodic phishing, password, data-handling, and acceptable-use awareness activities.
• Monitor completion of mandatory training and follow up on non-compliance.

• Maintain an inventory of suppliers, cloud providers, SaaS tools, and sub-processors that access company or customer information.
• Perform and document vendor due diligence and risk assessments before onboarding critical vendors and on a defined review cycle afterward.
• Ensure vendor contracts include appropriate security, confidentiality, incident-notification, data-return/deletion, and audit/assurance clauses.
• Collect and assess relevant vendor assurance documents, such as SOC reports, ISO certificates, penetration-test summaries, and security questionnaires.
• Support customer security questionnaires, RFPs, due-diligence requests, and contract-security reviews.

The Information Security & Compliance Manager will be authorized to:

• Request evidence and control-status updates from all departments.
• Require documented remediation plans for identified control gaps.
• Escalate unresolved high-risk issues directly to the CEO/CTO or security steering committee.
• Recommend suspension or restriction of access where a material security risk exists.
• Coordinate incident response across departments.
• Report independently on the effectiveness of the ISMS and SOC 2 controls.

• 3+ years of experience in information security, IT governance, GRC, internal audit, IT operations, cloud security, or compliance.
• Practical experience implementing or operating ISO 27001, SOC 2, or a comparable control framework.
• Strong understanding of risk assessments, risk registers, control design, evidence collection, internal audits, and corrective-action tracking.
• Working knowledge of access management, MFA, endpoint security, patching, backups, vulnerability management, logging, incident response, and cloud/SaaS security.
• Experience working with tools such as Jira/Freshdesk, Google Workspace or Microsoft 365, GitHub/GitLab, cloud platforms, HRMS, endpoint-management tools, and compliance/evidence platforms.
• Ability to write clear policies, procedures, risk reports, audit responses, and management presentations.
• Strong stakeholder-management skills; able to influence engineering, HR, operations, and leadership without creating unnecessary bureaucracy.
• High integrity, discretion, organization, and attention to detail.