Security & Compliance Lead

Archlet

. Own the daily execution of security and compliance at Archlet .

Posted 11/10/2026full-timeRemote • SpainSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing security and compliance programs, including ISO 27001 and SOC 2 Type II, while ensuring operational GDPR compliance and effective risk management. Proficient in cloud security practices and capable of delivering training and assessments to enhance organizational security posture.

Highest-signal resume keywords

ISO 27001 Compliance ManagementSOC 2 Type II Program ExecutionOperational GDPR ComplianceCloud Security PracticesRisk Assessment and Vendor Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information SecuritySecurity ComplianceGRCControl DesignAuditor ExpectationsEndpoint ProtectionApplication VulnerabilitiesData Processing AgreementsEnterprise Security QuestionnairesSecurity Program Management

Soft Skills

Excellent Written and Spoken EnglishOrganizational SkillsProject ManagementCollaborationTraining Delivery

Tools & Technologies

VantaAzureEntra IDIntuneMicrosoft DefenderAI-Assisted Workflows

Certifications & Qualifications

ISO 27001 CertificationISO 42001 Certification

Industry Keywords

SaaSCloud-Based SoftwareRisk RegistersPenetration TestingPrivacy Assessments

Tech Stack

Tools & technologies

AzureCloud

About the role

Key responsibilities & impact

Own the daily execution of security and compliance at Archlet
Own the ISO 27001 compliance program, maintain policies and evidence in Vanta, coordinate internal and external audits, and ensure control owners complete responsibilities and corrective actions
Build and execute Archlet’s first SOC 2 Type II program in 2027, including auditor selection and management, control and Vanta setup extensions, evidence coordination, and the final report
Serve as the first point of contact for security and compliance questions across the company
Complete customer assessments, explain safeguards, and maintain the Trust Center and reusable answers
Maintain risk registers, assess vendors, and keep subprocessor information current
Drive operational GDPR compliance and maintain DPAs, privacy assessments, and AI governance records
Lead annual independent penetration testing from scope and preparation through findings review, engineering tickets, retesting, and customer-facing reports
Partner with Platform and Application Engineering on cloud security, identity, secure development, and security validation of new features
Run access reviews, manage security-tool findings and routine security configurations, and coordinate recovery tests and incident-response preparation
Deliver employee and engineering training and run phishing exercises
Improve security processes through automation and thoughtful use of AI

Requirements

What you’ll need

Engineering background
Typically 5+ years in information security, security compliance, or GRC
Substantial responsibility in a SaaS or cloud-based software environment
Personally operated security programs and closed gaps, with results beyond recommendations and audit reports
Strong ISO 27001 experience
Independently managed an ISO 27001 audit cycle
Substantial delivery responsibility for a completed SOC 2 Type II cycle
Understanding of control design, operating evidence, auditor expectations, and remediation
Technical understanding of cloud architecture, authentication and authorization, least privilege, endpoint protection, logging, and common application vulnerabilities
Experience handling vendor assessments, risk registers, and operational GDPR requirements, including data processing agreements, retention, and international transfers
Experience completing enterprise security questionnaires
Excellent written and spoken English
Ability to organize competing requests, manage external providers, follow up with contributors, and drive work through to completion
Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance is valuable
ISO 42001 experience is a bonus

Benefits

Comp & perks

Full-time permanent employment
Autonomy to drive design decisions and make a real impact
Little bureaucracy and meetings
Supportive and innovative environment
Regular team activities, both virtual and in person