Lead – Security, Risk & Compliance

Embrace Software Inc

. Establish and manage a centralized security and compliance framework across portfolio companies .

Posted 11/3/2026full-timeRemote • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in establishing and managing security and compliance frameworks, with a strong focus on SOC 2 Type II and ISO 27001 certifications. Proficient in developing security policies, conducting risk assessments, and implementing security controls across cloud and application environments.

Highest-signal resume keywords

SOC 2 Type II CertificationISO 27001 ImplementationCloud Security (AWS/Azure)Vulnerability ManagementSecurity Policy Development

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Risk ManagementSecurity AssessmentsControl FrameworksTechnical Security ReviewsRemediation PlanningSecurity AuditsIncident ResponseData PrivacyAI Security GovernanceDisaster Recovery Planning

Soft Skills

Technical LeadershipCommunicationMentoringCollaborationIndependent Work

Tools & Technologies

Cloudflare/WAFVulnerability ScannersSIEMEndpoint ProtectionIAMAPI SecurityEncryptionFirewallsMonitoring ToolsDrata

Certifications & Qualifications

CISSPCISMCISACRISCCCSP

Industry Keywords

FERPAHECVATGovRAMPNIST 800-53FedRAMPStateRAMPGDPRFinTechSaaS SecurityRegulated Environments

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityFirewallsJavaMS SQL ServerSQL

About the role

Key responsibilities & impact

Establish and manage a centralized security and compliance framework across portfolio companies
Develop, implement, and maintain security policies, controls, and evidence templates
Lead SOC 2 Type I and Type II engagements end to end, including readiness, control implementation, evidence collection, auditor coordination, and reporting
Lead ISO 27001 implementation and certification, including ISMS scoping, Statement of Applicability, internal audits, and management reviews
Manage government, education, and legal-sector security requirements, including FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53, and contractual obligations
Conduct security risk assessments, maintain risk registers, track remediation and exceptions, and escalate material risks
Manage vulnerability assessments, penetration testing, remediation priorities, and security findings across applications and infrastructure
Conduct third-party and vendor security assessments, including subprocessors, software supply chains, and AI vendors
Develop and maintain business continuity, disaster recovery, security awareness, and secure development standards
Manage customer security reviews, questionnaires, audit evidence, and external auditor interactions
Establish and improve security processes, reporting, and controls across the portfolio
Implement and improve security controls across cloud, application, and infrastructure environments
Evaluate, configure, and optimize Cloudflare/WAF, vulnerability scanners, SIEM, endpoint protection, and security monitoring platforms
Conduct technical security reviews covering IAM, SSO/SAML, encryption, API security, privileged access, customer data isolation, and third-party integrations
Assess vulnerabilities, recommend remediation, and validate corrective actions with Engineering and Systems Administration
Review cloud and infrastructure security configurations, including firewall policies, DDoS protection, access controls, and security hardening
Provide hands-on technical guidance to security analysts and engineering teams
Mentor security team members, establish best practices, and improve internal capabilities through reviews and knowledge sharing

Requirements

What you’ll need

10+ years of experience in cybersecurity, risk management, and compliance, including end-to-end ownership of SOC 2 Type II or ISO 27001 certification
Proven experience developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation plans, using platforms such as Drata or Vanta
Strong hands-on experience with cloud and application security across AWS and/or Azure, including IAM, encryption, API security, secure development practices, and vulnerability management
Practical experience implementing and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools
Experience conducting technical security assessments, identifying vulnerabilities, implementing security controls, and validating remediation with Engineering and CloudOps teams
Experience managing vendor risk, security audits, and customer security reviews, preferably within education, government, legal, or other regulated SaaS environments
Strong technical leadership, communication, and mentoring skills, with the ability to work independently and collaborate across multiple portfolio companies and distributed teams
Experience with AI security and governance, including model risk assessments, prompt injection, data privacy, tenant isolation, and secure AI integrations
Familiarity with AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, and privacy regulations such as GDPR
Experience with security and compliance requirements in FinTech or financial services, including protection of sensitive financial data
Knowledge of FedRAMP/StateRAMP, HECVAT, and security requirements for education, government, and legal SaaS environments
Certifications such as CISSP, CISM, CISA, CRISC, or CCSP are a plus
Experience securing Microsoft SQL Server, Windows Server, Java applications, SAML/Shibboleth, and managed hosting environments

Benefits

Comp & perks

Competitive salary commensurate with experience
Opportunities for career advancement and professional development
Experience collaborating with a diverse, global team within a remote work setting