Source Job

• Lead the configuration and management of GRC tools to ensure integration with security systems.
• Manage the main dashboard for SOC 2 reporting, ensuring accuracy and compliance.
• Develop and maintain a comprehensive risk management program and conduct risk assessments.

Engine is transforming business travel into something personalized, rewarding, and simple. They have over 20,000 companies relying on Engine to support over 1 million travelers and billions in annual bookings each year and have been recognized as one of the fastest-growing travel and fintech platforms in North America.

• Lead customer due diligence questionnaire (DDQ) and RFP response process and third-party risk management process.
• Support enterprise sales with technical customer security discussions.
• Lead SOC 2 Type II audit preparation, evidence collection, and remediation.

Vanilla is an AI-powered estate advisory platform that aims to modernize estate planning. They are a startup distributed across the U.S. with a mix of fully remote and hybrid roles that embraces flexibility and values curious builders and problem-solvers.

• Manage inbound security questionnaires from partner physician practices.
• Lead security evaluations for Aledade’s vendors and analyze SOC2 reports.
• Maintain and optimize our security response repository and identify bottlenecks.

Aledade empowers independent primary care, becoming the largest network of its kind in the US. The company fosters a collaborative, inclusive, and remote-first culture, aiming to improve healthcare for patients, practices, and society.

• Own day-to-day execution of SOC 1, SOC 2, PCI DSS, and ISO 27001 readiness and audit cycles.
• Develop and maintain policies, procedures, risk assessments, control narratives, and supporting documentation.
• Facilitate risk assessments for systems, vendors, products, and business initiatives.

Astra is building mission-critical infrastructure for moving money at scale. Their platform processes billions in annual transaction volume with 99.9%+ uptime, powering real-time transfers, bank debits, card disbursements, and complex financial compliance systems.

• Lead SOC 2 and ISO programs through the full audit lifecycle.
• Build integrations that continuously gather compliance evidence from AWS, GitHub, identity providers, and internal systems.
• Evaluate and monitor third-party vendors for security and compliance risk.

Fieldguide is establishing a new state of trust for global commerce and capital markets through automating and streamlining the work of assurance and audit practitioners. The company is based in San Francisco, CA, and built as a remote-first company with a team that is inclusive, driven, humble and supportive.

• Serve as the primary vCISO and subject matter expert for multiple clients.
• Lead data-centric cybersecurity programs aligned to business risk.
• Manage, mentor, and develop vCISO team members.

Coretelligent partners with growing, highly regulated organizations that need secure, dependable IT environments built to scale. They deliver managed IT, cybersecurity, cloud, and strategy, through a model designed for consistency, transparency, and trust. They are building a team of professionals who care deeply about quality, ownership, and continuous improvement.

• Design and test prompts to shape AI behavior and review outputs.
• Build and maintain the “truth layer” for real-world GRC answers.
• Evaluate and improve AI quality, ensuring responsible AI use.

Vanta helps businesses earn and prove trust by continuously monitoring and verifying their security. They empower companies to practice better security and prove it with ease, with a kind and talented team that consists of both people with and without prior security experience.

• Own and maintain the compliance platform (Drata), including control mapping, evidence collection, continuous monitoring, and audit workflows
• Manage control documentation, policies, procedures, and supporting artifacts across multiple compliance frameworks
• Perform risk assessments, vendor security reviews, and control gap analyses, and track remediation through to completion

Payabli is a next-generation Payments Infrastructure and Monetization Platform purpose-built for vertical software companies. They empower software companies to manage and move money through a single infrastructure stack that delivers total control over the payments experience, scaling with PCI DSS 4.0 and SOC 2-compliant security.

• Coordinate compliance with standards (PCI, HIPAA, ISO 27002, SOC 1/2/3, FISMA/FedRAMP, etc.) under guidance.
• Maintain evidence repositories and partner with SMEs to refresh artifacts.
• Coordinate audits and certification efforts, partnering with support teams on timelines and resourcing.

Experian is a global data and technology company, powering opportunities for people and businesses around the world. As a FTSE 100 Index company listed on the London Stock Exchange (EXPN), they have a team of 22,500 people across 32 countries.

• Own and operate compliance programs such as SOC 2, ISO 27001, ISO27701, HIPAA, and TISAX.
• Lead and manage internal, external, and customer audits end-to-end.
• Track, remediate, and validate 100% of audit findings within agreed SLAs.

Airtable is the no-code app platform that empowers people closest to the work to accelerate their most critical business processes. More than 500,000 organizations rely on Airtable to transform how work gets done and they strive to create a workplace where everyone has an equal opportunity to thrive.

• Perform internal audits and vulnerability testing, ensuring security controls are monitored.
• Lead security architecture governance for internal IT and projects, using Unified Architecture Framework.
• Maintain compliance with security requirements and develop roadmaps to address evolving threats.

Jobgether is a platform connecting job seekers with companies. It uses AI-powered matching to ensure applications are reviewed quickly and fairly, identifying top candidates for employers.

• Scale, automate, and optimize existing GRC, compliance, and customer assurance programs.
• Optimize and automate an existing third-party risk program by improving risk signal quality.
• Evaluate, implement and maintain GRC tooling with a focus on AI-powered automation to minimize operational overhead.

Monarch is a personal finance platform designed to simplify finances. They are a fully remote team of do-ers led by experienced entrepreneurs passionate about helping members reach their financial goals, hyper-focused on building a product people love and evolving based on user feedback.

• You will review, challenge, and strengthen our systems, act as the security authority within engineering, define guardrails, and drive remediation when risks arise.
• Operating independently, you’ll build the structure and standards needed as we scale.
• Your mission is to own the company wide security strategy and architecture, ensure CIRO and SOC 2 alignment, and embed strong security practices across infrastructure, applications, and internal systems, while enabling engineering velocity.

Newton is changing how Canadians trade crypto, with the goal to make financial freedom something everyone can achieve by giving customers the tools and knowledge they need to navigate the crypto world. At Newton, you'll work with a remote team spread across Canada.

• Maintain and improve security policies and controls across the platform.
• Perform compliance validation and prepare for audits.
• Conduct risk assessments on new workloads and track mitigation actions.

Jobgether is a platform that connects job seekers with companies. They use AI-powered matching to ensure applications are reviewed quickly and fairly. We do not have enough information to assess the company size and culture.

• Own and lead enterprise-level compliance programs.
• Define and mature ISO 27001 and ISO 42001 control environments and SOX 404 ITGCs.
• Act as a subject matter expert and internal consultant for various teams.

Spring Health aims to eliminate mental health barriers with its clinically validated technology, Precision Mental Healthcare. They partner with over 450 companies, providing care for 10 million people and are valued at $3.3 billion.

• Lead security governance, risk management, and compliance efforts.
• Oversee security operations and incident response.
• Partner with IT, Clinical Operations, Privacy, and Compliance to ensure regulatory requirements and industry frameworks.

Tuesday Health is a value-based palliative care provider group dedicated to transforming serious illness and end-of-life care. Through their leading-edge care model, Tuesday Health is shaping the future of community-based palliative care nationwide.

• Maintain and improve security policies and controls across the platform.
• Perform compliance validation and prepare for audits.
• Conduct risk assessments on new workloads and track mitigation actions.

Jobgether is a platform that connects job seekers with companies. They use AI to match candidates with roles and ensure fair application reviews.

• Lead execution of the enterprise information security program.
• Oversee threat detection/response, vulnerability management, and incident response processes.
• Partner with Engineering and Infrastructure teams to secure cloud environments and CI/CD pipelines.

bswift transforms benefits administration, making it simpler and smarter. They serve thousands of companies and millions of people nationwide, reducing administrative burdens and freeing HR teams to focus on creating thriving, people-first workplaces.

• Assess and improve client security and IT controls.
• Develop policies, processes, and risk assessments aligned to top frameworks like NIST, ISO 27001, and SOC 2.
• Translate technical and regulatory requirements into clear, actionable steps for our clients.

Hotman Group is a rapidly growing boutique firm redefining cybersecurity and GRC. They help business leaders earn and keep customer trust through expert guidance and a commitment to quality, fostering a collaborative environment where every voice matters.

• Embed privacy-by-design principles into Docker products, services, and internal platforms.
• Partner closely with Docker engineering and product teams to integrate privacy requirements into architecture decisions, SDLC processes, and CI/CD pipelines.
• Design, develop, and maintain automated GRC and privacy workflows to support compliance monitoring, control testing, DPIAs, risk assessments, reporting, and audit readiness.

Docker makes app development easier so developers can focus on what matters. Their remote-first team spans the globe and they are passionate about innovation and great developer experiences. With over 20 million monthly users and 20 billion image pulls, Docker is a trusted tool for building, sharing, and running apps.