Lead – Security, Risk & Compliance

🔥 13 hours ago

🇺🇸 United States – Remote

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 25%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Embrace Software Inc

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2021

💼 Consulting

💸 Finance

Consulting • Software • Finance

Embrace Software Inc. is a business investment company that specializes in acquiring and building world-class software businesses across various industrial sectors. With a focus on mission-critical software, Embrace aims to add value to its portfolio of companies, which range from small and medium-sized businesses to Fortune 500 firms. The company supports its acquired businesses by providing resources and operational expertise to foster growth and enhance customer satisfaction.

📋 Description

• Establish and manage a centralized security and compliance framework across portfolio companies • Develop, implement, and maintain security policies, controls, and evidence templates • Lead SOC 2 Type I and Type II engagements end to end, including readiness, control implementation, evidence collection, auditor coordination, and reporting • Lead ISO 27001 implementation and certification, including ISMS scoping, Statement of Applicability, internal audits, and management reviews • Manage government, education, and legal-sector security requirements, including FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53, and contractual obligations • Conduct security risk assessments, maintain risk registers, track remediation and exceptions, and escalate material risks • Manage vulnerability assessments, penetration testing, remediation priorities, and security findings across applications and infrastructure • Conduct third-party and vendor security assessments, including subprocessors, software supply chains, and AI vendors • Develop and maintain business continuity, disaster recovery, security awareness, and secure development standards • Manage customer security reviews, questionnaires, audit evidence, and external auditor interactions • Establish and improve security processes, reporting, and controls across the portfolio • Implement and improve security controls across cloud, application, and infrastructure environments • Evaluate, configure, and optimize Cloudflare/WAF, vulnerability scanners, SIEM, endpoint protection, and security monitoring platforms • Conduct technical security reviews covering IAM, SSO/SAML, encryption, API security, privileged access, customer data isolation, and third-party integrations • Assess vulnerabilities, recommend remediation, and validate corrective actions with Engineering and Systems Administration • Review cloud and infrastructure security configurations, including firewall policies, DDoS protection, access controls, and security hardening • Provide hands-on technical guidance to security analysts and engineering teams • Mentor security team members, establish best practices, and improve internal capabilities through reviews and knowledge sharing

🎯 Requirements

• 10+ years of experience in cybersecurity, risk management, and compliance, including end-to-end ownership of SOC 2 Type II or ISO 27001 certification • Proven experience developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation plans, using platforms such as Drata or Vanta • Strong hands-on experience with cloud and application security across AWS and/or Azure, including IAM, encryption, API security, secure development practices, and vulnerability management • Practical experience implementing and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools • Experience conducting technical security assessments, identifying vulnerabilities, implementing security controls, and validating remediation with Engineering and CloudOps teams • Experience managing vendor risk, security audits, and customer security reviews, preferably within education, government, legal, or other regulated SaaS environments • Strong technical leadership, communication, and mentoring skills, with the ability to work independently and collaborate across multiple portfolio companies and distributed teams • Experience with AI security and governance, including model risk assessments, prompt injection, data privacy, tenant isolation, and secure AI integrations • Familiarity with AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, and privacy regulations such as GDPR • Experience with security and compliance requirements in FinTech or financial services, including protection of sensitive financial data • Knowledge of FedRAMP/StateRAMP, HECVAT, and security requirements for education, government, and legal SaaS environments • Certifications such as CISSP, CISM, CISA, CRISC, or CCSP are a plus • Experience securing Microsoft SQL Server, Windows Server, Java applications, SAML/Shibboleth, and managed hosting environments

🏖️ Benefits

• Competitive salary commensurate with experience • Opportunities for career advancement and professional development • Experience collaborating with a diverse, global team within a remote work setting

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume