Act as part vCISO and account manager, guiding clients through security and compliance programs.
Assess security posture, provide recommendations, and design programs using NIST, SOC 2, and ISO 27001.
Liaise with auditors and internal teams to translate programs into policies, procedures, and configurations.
Oneleet provides a platform for companies to build, manage, and monitor cybersecurity programs and achieve SOC 2 and ISO 27001. It raised a $33M Series A and is a fast-growing, remote-first team with an opinionated culture.
Lead compliance programs including SOC 2, GDPR, CCPA/CPRA, and Shopify partner security requirements.
Own security policies, risk management, business continuity, and incident response.
Manage IT operations, endpoint security, and cloud security across the company.
Rebuy revolutionizes shopping with intelligent, personalized experiences for DTC brands. They are a fully remote team with a culture rooted in ownership, drive, and empathy.
Own and mature security, privacy, and compliance programs across HIPAA, SOC 2, and HITRUST.
Lead HITRUST certification end to end, including scoping, evidence collection, and assessor coordination.
Partner with Engineering, Product, SRE, and IT to integrate security into architecture, SDLC, and cloud infrastructure.
IntusCare is an end-to-end ecosystem built specifically to help PACE programs deliver exceptional care, strengthen financial performance, and stay compliant. It is a growing healthcare SaaS organization that empowers teams to improve outcomes for dual-eligible seniors.
Maintain and enhance Anovia's ISO/IEC 27001 ISMS, including policies, controls, risks, and audit coordination.
Support SOC 2, HIPAA, and other compliance programs, including vendor assessments, vulnerability management, and incident response.
Lead ambiguous technical and operational initiatives from planning through implementation, coordinating stakeholders and driving completion.
Anovia is an industry-leading technology outsourcing support provider specializing in workflow and knowledge processes, technical support, helpdesk, and multilingual services. With over 200 experts globally, we serve Fortune 500 companies and value growth, learning, and work-life balance.
Own security infrastructure: implement, configure, and monitor technical controls supporting SOC 2 and ISO 27001, including Vanta, SSO, endpoint management, and security monitoring.
Manage identity and access: design and operate IAM policies, enforce least-privilege access, and keep SSO configured correctly across the stack.
Run technical incident response: own detection, triage, and technical response, maintaining runbooks that hold up under pressure.
Syllo is defining the Litigation AI category with a unified platform that autonomously manages the entire litigation lifecycle end-to-end. Founded in 2019, the company supports Fortune 500 and AmLaw 200 firms, and its team has doubled in six months with a fast-scaling, enterprise-focused culture.
Own and drive Sourcegraph's governance, risk, and compliance program, including SOC 2 and ISO 27001 certifications.
Manage audits end-to-end: evidence collection, control testing, stakeholder coordination, and remediation.
Support customer-facing compliance activities and tailor controls to fit Sourcegraph's fast-moving environment.
Sourcegraph builds AI-powered code search and batch change tools for engineering teams to manage complex codebases. It is a globally distributed team backed by a16z, Sequoia, and Redpoint, valuing high agency and customer love.
Drive end-to-end audit cycles for SOC 2 Type II and ISO 27001/27701/42001, including evidence collection, control testing, auditor liaison, and remediation tracking.
Support FedRAMP program efforts, vendor risk assessments, and customer security assurance.
Automate compliance processes using Tines and operate continuous control monitoring.
Tines is the intelligent workflow company that powers important workflows by integrating with any API-enabled service for IT and security teams. The company values Simplicity, Speed, and Soundness, fostering a culture of curiosity, growth, and integrity.
Monitor and triage security alerts, coordinate incident response, and run tabletop exercises.
Maintain technical security controls including encryption, key/certificate management, and secrets rotation.
Support SOC 2 and GDPR compliance through vendor reviews, client questionnaires, and evidence collection.
Graphite is a technology-enabled growth agency that helps fast-growing companies like Masterclass, Notion, and BetterUp unlock sustainable revenue through content, SEO, and AEO. We are a fully distributed team across North America, Latin America, and Europe, obsessed with impact and delivering outcomes for clients.
Lead external compliance exams (SOC 2, ISO 27001) end-to-end, including evidence, auditor negotiation, and readiness.
Own customer security diligence, questionnaires, audits, and trust-center content while setting response standards.
Manage third-party risk operations and the agent platform for automated customer and vendor assessments.
Chainguard provides hardened, secure, and production-ready builds of open source software, helping organizations build faster, stay compliant, and eliminate risk. It is a venture-backed company serving Fortune 500 enterprises and global industry leaders like OpenAI and Snowflake.
Own the day-to-day operation and continuous improvement of ISO 27001, SOC 2, and GDPR compliance programs.
Lead the pursuit of CMMC certification, agency-specific ATOs, and NIST SP 800-171 compliance.
Serve as the organization's DPO and oversee vendor risk, audits, and security awareness training.
Mechanical Orchard specializes in safely rewriting the most critical and complex business applications to make them adaptable and resilient. The company is an experienced Agile software consultancy that values cross-functional teams, collective ownership, and continuous improvement, and is bringing joy to beleaguered IT teams.
Own Pasito's security, IT, and compliance program end to end, including Vanta, SOC 2, HIPAA, and pen tests.
Manage IT operations: identity, SSO, MDM, device lifecycle, and internal access requests.
Partner with engineering, legal, HR, and sales to remediate vulnerabilities, complete security questionnaires, and maintain risk posture.
Pasito is an AI-native workspace for employee benefits that unifies plan design, payroll, claims, and financial data. Backed by Y Combinator and serving major U.S. carriers, it's a fast-growing startup that values speed, collaboration, and accuracy.
Own SOC 2 end to end, run auditor relationships, and keep the program audit-ready year round.
Run risk management, policy, BC/DR, and vendor/subprocessor programs with automated evidence.
Lead security questionnaires and TPRM reviews to close deals and scale compliance across frameworks.
Aegis AI is a security company founded by ex-Google engineers who built Safe Browsing and reCAPTCHA, now stopping adversarial AI attacks. The team is flat, flexible, and fast, with clear KPIs and a focus on owning decisions while moving at real-world speed.
Partner with business leaders to translate priorities into practical security and risk decisions.
Lead project security assessments, rapid risk reviews, and remediation planning for new products and enterprise changes.
Communicate threats, incidents, and policy changes to leadership using a threat-informed, business-aligned approach.
Experian is a global data and technology company, powering opportunities for people and businesses around the world. We have an amazing team of 25,200 people in 32 countries and invest in new advanced technologies to unlock the power of data.
Own and support key GRC programme components, including ISO 27001 and SOC 2 audits.
Lead risk assessments, third-party risk oversight, and control assurance activities.
Partner with Engineering, Privacy, Legal, and People teams to embed compliance requirements.
Ping Identity is a cloud identity security company serving more than half the Fortune 100 with secure, seamless digital experiences. Headquartered in Denver with global offices, it fosters a flexible, collaborative culture that champions every individual identity.
Lead the implementation and certification of Accela's ISO/IEC 27001:2022 program.
Manage risk assessments, controls, audits, and compliance documentation across cross-functional teams.
Drive compliance automation and evidence management using platforms like Drata.
Accela provides a cloud-based government software platform that helps agencies improve efficiency and transparency. For nearly 20 years, it has been an industry leader serving communities of all sizes, with a culture committed to diversity, equity, and inclusion.
Serve as subject matter expert and working lead for IEC 62443 certifications, owning the gap between standards and practice.
Maintain SDLC process documentation, traceability, and compliance evidence for audits, certifications, and regulatory obligations.
Coordinate the Coordinated Vulnerability Disclosure (CVD) and incident management program, including CISA and ENISA reporting readiness.
Inductive Automation provides industrial automation software solutions, empowering customers to turn great ideas into reality by removing technological and economic obstacles. The company fosters a collaborative, flexible culture with an emphasis on work-life balance, personal growth, and social connection.
Own end-to-end delivery of GRC engagements across ISO 27001, SOC 2, and GDPR.
Manage multiple concurrent client engagements with high autonomy and consistent quality.
Develop reusable GRC methodologies and AI-assisted compliance workflows.
A GRC consulting firm delivering Governance, Risk, and Compliance programs across ISO 27001, SOC 2, and GDPR for international clients. Operates with a remote, collaborative culture emphasizing trust, transparency, and high-autonomy delivery.
Own customer security reviews and compliance programs, driving fast and accurate responses.
Ensure practical risk decisions and reliable security answers through automation and AI.
Scale the function by building processes and self-service resources."
The company is a technology company that builds quickly and focuses on security and compliance. It is a remote-first small team with a culture of autonomy and growth.
Own global certification programs like ISO 27001 and SOC 2, and advise engineering teams on secure development.
Collaborate directly with engineers to audit cloud infrastructure, CI/CD pipelines, and AI-driven security controls.
Assess risks of emerging technologies and drive continuous compliance improvements across the organization.
Picus Security is an exposure validation company that proves what attackers can exploit and what defenses stop, turning exposures into defensible decisions. As a fast-growing global remote team, it values continuous security validation and has a 95% recommendation rate.
Perform activities to measure and monitor compliance with company policies and procedures.
Facilitate certifier requests and information gathering for external and internal audits.
Lead onsite and remote audits, both certification and customer audits, to ensure compliance.
ServiceNow provides the AI control tower for business reinvention, bringing together AI, data, and workflows to help 85% of the Fortune 500 work smarter, faster, and better. The company fosters an AI-native culture where technology and talent are unstoppable together, with a large global employee base.