Director, Security & Compliance

Job not on LinkedIn

🔥 19 hours ago

❄️ Minnesota – Remote

❄️ Minnesota – Remote

⏰ Full Time

🔴 Lead

🚔 Compliance

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Murphy-Hoffman Company (MHC Kenworth)

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 1975

🚘 Automotive

🏭 Manufacturing

🛡️ Insurance

Automotive • Manufacturing • Insurance

Murphy-Hoffman Company (MHC Kenworth) is a full service dealership network specializing in the sale and servicing of heavy-duty and medium-duty trucks, predominantly featuring Kenworth and Volvo brands. With over 130 locations across 19 states, MHC offers a wide range of services including truck sales, leasing, financing, and repair services. Their commitment to customer service is supported by 24/7 operations in major markets and a robust inventory of trucks and parts.

📋 Description

• Own renewal and continuous operation of the SOC 2 Type II report and serve as primary liaison to the audit firm • Mature the control environment and reduce manual evidence collection • Develop, document, and operate controls aligned with SOC 2 Type II, HIPAA, PCI, and GDPR/CCPA • Work directly with auditors to ensure ongoing compliance • Expand the company's attestation footprint as needed • Serve as primary contact for customer security reviews, questionnaires, and due-diligence requests • Maintain the security policy suite, risk register, and incident response plan • Run tabletop exercises • Establish data classification, retention, and access-control standards • Partner with engineering on least-privilege access, encryption, and data lifecycle management • Develop and implement secure software development lifecycle policies and environmental and physical security standards • Own vendor and third-party risk management, including reviews of SaaS and AI tools • Assist Legal with security and data privacy contract negotiations • Build the company's AI governance framework, including acceptable use policies, model/vendor risk assessment, and oversight of AI data handling • Track emerging AI standards and translate them into practical controls • Partner with product and engineering on responsible AI practices • Provide security and compliance input on shadow AI risk • Advise the executive team and board on security and compliance posture • Partner with Sales and Customer Success during enterprise deals • Build out the security/compliance function

🎯 Requirements

• Bachelor’s degree in Computer Science, Information Security, or a related field • 6+ years of experience across security, compliance, IT/GRC, or risk management • At least 2+ years running a SOC 2 program day-to-day, including evidence collection, control monitoring, and auditor management • Direct, hands-on experience operating and renewing an existing SOC 2 Type II program • Working knowledge of data governance practices, including classification, retention, access review, and CCPA/GDPR • Familiarity with AI governance concepts and frameworks including NIST AI RMF, OWASP LLM Top 10, and ISO 42001 • Experience writing policies and configuring compliance automation tools • Strong written and verbal communication skills • Experience with compliance automation platforms such as Vanta, Drata, Secureframe, or similar • Vendor/third-party risk assessment and management skills • Ability to build credibility with enterprise customers and prospects on security and trust topics • Candidates must be based in the United States • This role is not eligible for visa sponsorship • Preferred: CISSP, CISM, CIPP, or CISA • Preferred: Experience achieving or maintaining ISO 27001 or ISO 42001

🏖️ Benefits

• Flexible, work-where-you-live model • 401(k) plan with deferred and Roth options • Employer match of 50% up to a maximum of 4.5% of gross pay • Comprehensive medical plans with co-pay or HSA coverage options • Dental and vision plans • Daycare and Medical FSA/HSA • $50,000 group term life insurance coverage • Generous paid time off (PTO) policies • Employee Assistance Program (EAP) • Additional life insurance • Critical illness insurance • Accident, cancer and hospital indemnity insurance • Legal/ID Shield • Pet insurance • Paid family or medical leave where provided by state programs • Four weeks of paid paternity leave after one year of employment, with partial eligibility beginning at six months, in states without a state program • Twelve weeks of paid leave for the birth parent, subject to eligibility rules