Information Security & Compliance Manager

Position summary
We are seeking an Information Security & Compliance Manager to establish, operate, and continually improve our Information Security Management System (ISMS) and security compliance program. The role will lead our readiness and ongoing compliance for ISO/IEC 27001:2022 certification and SOC 2 reporting.
The successful candidate will translate security and compliance requirements into practical processes for a growing IT organization, coordinate technical and business teams, maintain audit-ready evidence, manage security risks and incidents, and report security performance to senior management.
Key responsibilities1. ISMS, governance, and policy management
Establish, maintain, and improve the company’s ISMS in line with ISO/IEC 27001:2022.
Define and maintain the ISMS scope, information-security objectives, interested-party requirements, Statement of Applicability (SoA), risk-treatment plan, and compliance obligations register.
Draft, maintain, communicate, and periodically review security policies, standards, procedures, and records.
Ensure policies and procedures are practical for the company’s actual working model, including remote work, cloud services, software development, support operations, and customer-data handling.
Maintain a clear RACI/responsibility matrix for security controls, including control owners, evidence owners, approvers, reviewers, and escalation paths.
Organize management-review meetings, prepare security metrics and risk reports, record decisions, and track actions to closure.
Coordinate internal audits, external certification audits, SOC 2 readiness assessments, and SOC 2 examinations.
2. SOC 2 program and audit evidence
Lead SOC 2 readiness and maintain compliance with the applicable Trust Services Criteria.
Work with management and the auditor to determine the appropriate SOC 2 scope—normally Security first, with Availability, Confidentiality, Processing Integrity, and/or Privacy included only where required by customers and services.
Maintain a control matrix mapping SOC 2 requirements to company policies, processes, technical configurations, control owners, and evidence.
Create and manage an evidence calendar covering monthly, quarterly, annual, and event-driven controls.
Collect, validate, organize, and retain audit evidence, such as access-review records, onboarding/offboarding records, change approvals, vulnerability reports, training completion, incident records, backup-testing results, supplier reviews, and management-review minutes.
Coordinate with external auditors and respond to audit queries, exceptions, corrective actions, and remediation requests.
Ensure evidence proves that controls operated consistently throughout the SOC 2 audit period, especially for a Type II report.
SOC 2 readiness typically requires demonstrable evidence around risk assessment, access controls, monitoring, incident response, vendor management, change management, and security awareness—not merely written policies.
3. Risk management and compliance
Establish and manage the information-security risk-assessment methodology, risk register, treatment plans, risk owners, due dates, and risk-acceptance process.
Conduct periodic and change-triggered risk assessments for systems, products, projects, new vendors, cloud services, and material changes.
Track legal, contractual, and customer security requirements relevant to the business.
Identify control gaps, assess impact and likelihood, recommend treatment options, and escalate overdue or high risks to leadership.
Monitor compliance with security policies and coordinate corrective and preventive actions.
4. Technical security oversight
Partner with IT, DevOps, engineering, HR, and operations teams to implement and monitor security controls.
Oversee identity and access management, including least privilege, MFA, privileged-access controls, joiner-mover-leaver processes, and periodic access reviews.
Coordinate vulnerability management, patching, endpoint protection, secure configuration baselines, log monitoring, and remediation tracking.
Review cloud and SaaS security configurations, including AWS/Azure/GCP, Microsoft 365/Google Workspace, source-code repositories, ticketing systems, CRM, and backup platforms, as applicable.
Ensure secure development and change-management practices are documented and followed, including code review, testing, deployment approval, and emergency-change processes.
Review backup, disaster-recovery, and business-continuity arrangements; coordinate periodic tests and document outcomes.
The role may oversee these activities but does not need to personally administer every platform. Technical system owners should execute relevant controls and provide evidence.
5. Incident management and awareness
Maintain and test the incident-response plan, incident-severity model, internal escalation process, and customer-notification process.
Coordinate security incident investigation, containment, recovery, post-incident review, root-cause analysis, and improvement actions.
Maintain the incident register and ensure lessons learned are converted into tracked improvements.
Develop and deliver security-awareness training for employees, contractors, and relevant third parties.
Conduct onboarding security briefings and periodic phishing, password, data-handling, and acceptable-use awareness activities.
Monitor completion of mandatory training and follow up on non-compliance.
6. Vendor and customer assurance
Maintain an inventory of suppliers, cloud providers, SaaS tools, and sub-processors that access company or customer information.
Perform and document vendor due diligence and risk assessments before onboarding critical vendors and on a defined review cycle afterward.
Ensure vendor contracts include appropriate security, confidentiality, incident-notification, data-return/deletion, and audit/assurance clauses.
Collect and assess relevant vendor assurance documents, such as SOC reports, ISO certificates, penetration-test summaries, and security questionnaires.
Support customer security questionnaires, RFPs, due-diligence requests, and contract-security reviews.
Authority and accountability
The Information Security & Compliance Manager will be authorized to:
Request evidence and control-status updates from all departments.
Require documented remediation plans for identified control gaps.
Escalate unresolved high-risk issues directly to the CEO/CTO or security steering committee.
Recommend suspension or restriction of access where a material security risk exists.
Coordinate incident response across departments.
Report independently on the effectiveness of the ISMS and SOC 2 controls.
Essential qualifications
3+ years of experience in information security, IT governance, GRC, internal audit, IT operations, cloud security, or compliance.
Practical experience implementing or operating ISO 27001, SOC 2, or a comparable control framework.
Strong understanding of risk assessments, risk registers, control design, evidence collection, internal audits, and corrective-action tracking.
Working knowledge of access management, MFA, endpoint security, patching, backups, vulnerability management, logging, incident response, and cloud/SaaS security.
Experience working with tools such as Jira/Freshdesk, Google Workspace or Microsoft 365, GitHub/GitLab, cloud platforms, HRMS, endpoint-management tools, and compliance/evidence platforms.
Ability to write clear policies, procedures, risk reports, audit responses, and management presentations.
Strong stakeholder-management skills; able to influence engineering, HR, operations, and leadership without creating unnecessary bureaucracy.
High integrity, discretion, organization, and attention to detail.

Work arrangement
No