Information Security & Compliance Manager (GRC)

RocketParts is a fast-growing software development agency founded by two experienced engineers who have built large-scale systems for companies like Riot Games, ScoreBig, and Universal Music Group.
Our mission is to empower businesses to tackle any software development challenge with purpose-fit solutions, professional expertise, realistic expectations, and results-driven outcomes.
We know firsthand the effort it takes to build great software. Our goal is to create a workplace where engineers can thrive, take pride in their work, grow, and be part of a high-performing team.
The Role
We are hiring an Information Security & Compliance Manager to lead SOC 2 Type II and PCI DSS 4.x compliance and own the security and compliance program end-to-end, keeping it audit-ready. The role runs in two directions. Internally, you own the program: policies and guidelines, access reviews, security-awareness training, vendor and risk reviews, the control-to-evidence mapping in Vanta, incident response, and the security questions that arrive from customers and prospects. Externally, you carry the same work into client engagements, supporting the companies we build software for through their own SOC 2 and PCI DSS programs — each with its own scope, auditor and deadlines. Throughout, you work alongside the engineers actually building these systems, which means your recommendations have to be implementable, not just defensible on paper.
What You'll Do
Drive SOC 2 Type II and PCI DSS 4.x readiness and continuous compliance — scoping, control design, evidence, auditor coordination, and remediation
Own the security and compliance program: policies and guidelines, access reviews, security-awareness training, vendor and risk reviews
Maintain the control-to-evidence mapping in the compliance tooling (Vanta) and keep policies and operational docs consistent
Coordinate incident response and field security questions from customers and prospects
Support client engagements through their own SOC 2 Type II and PCI DSS 4.x programs — each with its own scope, auditor and deadlines — working alongside the engineering teams actually building those systems, so remediation is implementable rather than theoretical
What You Bring
4+ years in information security, GRC, or IT compliance, with hands-on SOC 2 (ideally Type II) and PCI DSS experience
Working knowledge of common frameworks and cloud environments (GCP/AWS)
Clear writing — audit-ready documentation and the ability to explain requirements to engineers and non-technical stakeholders
U.S.-based. Certifications (CISSP, CISA, CISM) are a plus
Nice to Have
Payments or fintech background — most of what we build touches money movement
Familiarity with PCI DSS 4.x future-dated requirements, which became mandatory in March 2025
Exposure to ISO 27001, HIPAA, GDPR or NIST
Consulting or agency experience — you will be in front of clients and running more than one program at a time
How We Work
Fully remote, across 14 jurisdictions and five continents
Small senior teams. This is a startup environment rather than a large enterprise one
AI use is mandatory for our engineers, and we expect the same pragmatism from everyone else
Direct communication, high autonomy, low process overhead
Why Is This Great For Me?
Fully remote
Full premium benefits
401K match
Unlimited PTO
Your role and responsibilities will expand as the company grows
Work remotely with the flexibility to set your own schedule and take vacations
We respect work-life balance and don't require more than 40 hours per week unless you choose to
Collaborate with driven and motivated colleagues
Enjoy an open-minded culture that values opinions and feedback
Minimal meetings, maximizing your productivity
RocketParts asks respectfully to only apply through the application form and not email/apply to them directly. Recruiters and Agencies please do not RocketParts contact directly.

Work arrangement
Yes