Senior Engineering Manager, Security & IT

Responsibilities

Security Strategy & Application Security

• Define and own the application security roadmap, including vulnerability management, penetration testing, security reviews for new features and architectural changes.
• Build security-by-default practices into engineering workflows.
• Own the vendor security assessment process.
• Define zero-trust security principles and ensure they are embedded across the cloud platform and engineering organization.

Compliance & GRC

• Own the annual SOC 2 Type 2 audit cycle, including evidence collection, auditor management, and control maturation.
• Drive compliance expansion, evaluating frameworks such as ISO 27001, GDPR, HIPAA, and customer-specific requirements.
• Manage and develop the Compliance Lead.
• Lead security questionnaires, customer due diligence calls, and contractual security requirements during enterprise sales cycles.
• Own and maintain the policy framework and ensure policies are embedded in team workflows.

IT Operations

• Manage the Lead IT Engineer and provide strategic direction for IT operations.
• Own IT strategy, including tooling, access management, Okta, SCIM/SAML provisioning, endpoint management, and identity governance.
• Scale IT operations with engineering headcount growth through proactive capacity planning.
• Define and enforce IT security policies covering device management, access reviews, and offboarding.

Cross-functional Leadership & Communication

• Communicate security posture, compliance status, and IT health to the VP of Engineering with recommendations.
• Partner with the Cloud Platform Senior Manager on network security, IAM standards, security logging, and alerting.
• Embed security practices across product engineering teams.
• Represent the company's security and compliance posture to enterprise customers, prospects, and auditors.

Requirements

• 7+ years of experience in security, IT, or GRC.
• At least 3 years of team management experience.
• Fluency across application security, IT operations, and compliance/GRC.
• Application security expertise, including OWASP, vulnerability management programs, and engineering security review processes.
• IT operations leadership experience, including identity and access management, endpoint management, and remote workforce IT at scale.
• Strong strategic communication skills, with the ability to translate security and compliance complexity into business language.

Nice-to-haves

• Experience owning a SOC 2 audit cycle.
• Experience with ISO 27001, GDPR, or HIPAA.
• Familiarity with Snyk, Wiz, Cloudflare, and Okta.
• Experience answering enterprise security questionnaires and participating in customer due diligence.
• Experience in a high-growth SaaS company.

Benefits

• 100% remote work in a globally distributed organization.