Information Security & Compliance Lead

Information Security & Compliance Lead
Role Type: Senior Individual Contributor / Functional Lead
Function: Information Security, Risk & Compliance
Reporting To: VP Technology
About the Role: Own the compliance programs that support secure, trustworthy AI products. We are looking for a hands-on IT Security & Compliance Lead who can maintain year-round audit readiness, produce high-quality documentation, automate evidence collection and drive findings to closure.
Our AI products work with business data and connected systems to take action across real-world workflows. You will help controls and governance keep pace across the organization.
Reporting to VP Technology, you'll independently run compliance operations and work with auditors, Engineering, Platform/DevOps, Product, HR and other business teams. This is a senior individual contributor role where success comes through direct ownership, sound judgment and cross-functional follow-through.
The ideal candidate can lead an audit, write clear policies, automate recurring compliance work and hold teams accountable for remediation. Technical teams implement the controls; you ensure that requirements, evidence and corrective actions are complete.
What you’ll own
Security & Compliance Program Ownership: Independently own our current compliance scope: SOC 2 Type II, ISO 27001:2022, PCI-DSS, HIPAA and CSA STAR/CCM. Drive control operation, audit readiness, auditor interactions and corrective actions through closure throughout the year.
Audit & Evidence Operations: Plan and conduct internal audits, coordinate external audits and maintain a recurring evidence calendar across functions. Automate evidence extraction and validation from source systems wherever practical, at the required monthly or quarterly cadence. Identify and address gaps before audits.
Policies & Documentation: Create and maintain accurate policies, procedures, risk assessments, control narratives, root-cause analyses and corrective-action plans. Ensure documents reflect actual practices and are ready for approval, customer review or auditor use without substantial rewriting.
AI & Automation for Compliance: Use approved AI tools and practical scripts or workflows to improve evidence collection and validation, policy review, audit preparation, reporting and vulnerability tracking. Reduce manual follow-ups, validate outputs and remain accountable for accuracy and data protection.
Security Testing & Remediation Closure: Coordinate penetration tests and vulnerability assessments. Assign findings to responsible teams, track risk-based deadlines and verify closure evidence. Escalate overdue items and ensure exceptions have explicit approval, an owner and a review date.
Cross-Functional Accountability: Establish owners and deadlines for compliance commitments. Follow through to completion and promptly escalate missed commitments or at-risk deadlines through functional leaders and senior management, stating the risk and required action.
Priority AI Assurance — Next 12 Months: Lead readiness and execution toward CSA STAR for AI Levels 1 and 2, alongside ISO/IEC 42001:2023 certification. Plan AI Controls Matrix (AICM) implementation, Level 1 self-assessment, Level 2 assurance, evidence, gap closure and external assessments. Coordinate with Engineering and Product, and report progress, risks and dependencies against agreed milestones.
AI Product Governance: Define and review requirements for how AI products handle enterprise data, including access, permissions, retention, tenancy, inference, training boundaries and third-party AI services. Work with technical teams that implement these controls.
Cloud & Product Security Oversight: Define security requirements and review control effectiveness with Engineering and Platform/DevOps across cloud infrastructure, applications and product development. Those teams own technical implementation; you own compliance oversight, evidence and follow-through.
Risk & Resilience Oversight: Maintain the security risk register and oversee compliance for incident response, business continuity and disaster recovery. Coordinate exercises, documentation and corrective actions. Engineering, Platform/DevOps and business owners execute response and recovery plans.
Privacy & Vendor Risk: Conduct vendor security reviews and sub-processor assessments. Work with Legal to identify applicable privacy obligations and translate them into controls, evidence and follow-up actions.
Government Readiness: Assess gaps and plan FedRAMP and GovRAMP preparedness in line with the approved roadmap. Use CSA CCM-to-FedRAMP mappings to reuse controls and evidence, reduce duplicate work and address program-specific gaps. Track each program’s assessment and authorisation requirements separately.
Limited Customer Support: Provide compliance information or brief support to DevOps for customer security reviews when needed. DevOps leads these interactions because they are primarily technical. Broader security leadership within that customer-facing team may be considered based on the individual’s capabilities and agreed scope.
What we’re looking for
Required Compliance Ownership: Demonstrated hands-on, end-to-end ownership across all five current programs: SOC 2 Type II, ISO 27001:2022, PCI-DSS, HIPAA and CSA STAR/Cloud Controls Matrix (CCM). Experience must cover ongoing control operation, evidence management and corrective-action closure.
Audit Leadership: Experience independently planning and conducting internal audits and managing external audit readiness, evidence and auditor interactions. Ability to identify control gaps and drive findings through verified closure.
Documentation Quality: Independently produce clear, accurate policies, procedures, risk assessments, root-cause analyses, corrective-action plans and formal audit responses with minimal editorial support. Explain requirements clearly to technical and business teams.
Evidence Automation & AI Adoption: Practical ability to use approved AI tools, scripts and workflow automation to collect and validate evidence, review policies and produce reports. Validate outputs and protect sensitive data; software development expertise is not required.
Remediation & Escalation: Experience driving vulnerability remediation with Engineering and DevOps, assigning owners and deadlines, verifying closure and securing approved exceptions. Hold technical and business stakeholders accountable and escalate unresolved commitments promptly.
Proactive Execution: Independently prioritize and close compliance activities. Identify missing evidence, control weaknesses and at-risk deadlines, and take action before an audit or management follow-up.
Priority AI Assurance Experience — Highly Desirable: Hands-on experience with ISO/IEC 42001:2023 and CSA STAR for AI Levels 1 and 2, including the AI Controls Matrix (AICM), self-assessment and external assurance. These are high-priority objectives for the next 12 months.
Relevant Experience: 8+ years in information security, security governance, governance, risk and compliance (GRC), IT risk or a closely related field.
Technical Understanding: Understand cloud security, preferably Amazon Web Services (AWS), and software-as-a-service (SaaS) environments. Be comfortable reviewing application security, vulnerabilities, penetration testing, incident response and disaster recovery with technical teams.
AI Security & Governance Knowledge: Understand artificial intelligence (AI) and large language model (LLM) security, responsible AI practices and the controls needed to govern AI products.
Privacy & Regulatory Judgment: Work with Legal to assess applicable security and privacy obligations and translate them into practical controls and evidence requirements.
Future Government Programs — Desirable: Additional experience preparing for FedRAMP and GovRAMP.
Certifications such as CISSP, CISM, CISA, CRISC, CCSP or ISO Lead Auditor / Implementer are a plus.
Why This Role Is Different
This isn't a role where you inherit a checklist and keep it running. You'll build a reliable compliance function and help deliver our priority AI assurance roadmap. Your impact will come from independent ownership, sound documentation, practical automation and sustained follow-through across teams. If you enjoy owning problems end-to-end, working close to technology and turning security into a business enabler, we'd like to hear from you.
About us:
Belzabar Software Design is a world-class software boutique with headquarters in the US and an impressive development record that spans a number of major projects. Every day, millions of people use the software developed by Belzabar.
Belzabar Software develops Web and mobile-based products for diverse clientele that includes Fortune 500 companies, government agencies, and Web startup ventures.
We excel at developing advanced systems that solve an organisation challenge optimally, from performance and mathematical optimisation perspectives.
What we do: We work on prominent, high-performance projects for prominent organisations as well as innovative startups

Work arrangement
Yes