Security Compliance Manager
Leads security compliance programs, manages audits (ISO, SOC), implements ISMS, and oversees risk management. Requires 4+ years in risk assessments, 2+ years in audits, and strong knowledge of privacy laws like CCPA/GDPR.
About the job
Responsibilities
- Manage Hive’s current risk management program
- Manage external and internal audits, including reviewing materials that require attention for accuracy and properly adhering to regulatory expectations
- Implement ISMS in coordination with executive and mid-level management
- Develop reports that capture key business trends, highlights, lowlights, and metrics as the compliance programs are conducted. Provide status, recommended updates, and detailed metrics and evidence
- Work with Engineering and Product teams to identify process improvements and efficiencies in areas of change management, access management and general technology process controls
- Provide compliance, risk, and controls expertise to support information security and compliance initiatives
- Protect the business by assisting with cyber security risk assessments
- Maintain awareness of industry best practices for data maintenance handling as it relates to your role
- Manage a comprehensive Governance, Risk and Compliance program
- Adhere to and champion policies, guidelines and procedures pertaining to the protection of information assets
- Manage external security, privacy, and compliance requirements, including both internal requirements for vendors as well as external requirements placed on Hive
- Report actual or suspected security and/or policy violations/breaches
- Define, develop, implement, and maintain our policies and processes that enable consistent, effective privacy practices that minimize risk and ensure the confidentiality of protected information, paper and/or electronic, across all media types and comply with applicable privacy laws and regulations
- Support Hive’s security review process from beginning to end by identifying all necessary internal stakeholders based on the request (e.g., security survey, audit, review), assembling relevant and appropriate documentation, drafting responses, scheduling and leading calls/meetings, and communicating follow-up activities
- Serve as a subject matter expert for information security principles and practices (especially as they pertain to vendors and cloud security), and promoting a culture of security throughout the firm
- Interface with staff throughout the firm to facilitate the efficient and secure use of technology services
Requirements
- Bachelor's degree or related experience
- Minimum 4+ years experience related to conducting risk-based assessment for information systems and/or operations
- Minimum 1+ years experience running a comprehensive Governance, Risk and Compliance program
- Minimum 2+ years experience leading industry standard (ISO 27001 or SOC 1/2) audits from either side
- Strong knowledge of applicable privacy laws (CCPA/CPRA, GDPR)
- Thorough understanding of vulnerability management, penetration testing, and attack simulations
- Experience supporting enterprise-wide Security Compliance programs designed to anticipate, assess, and minimize control gaps and audit findings
- Ability to communicate in a written and oral format to technical and non-technical audiences in a business-friendly manner
- Demonstrated success in a competitive environment
- Highly self-motivated and ambitious in achieving goals
- Strong team player, but can work and execute independently
- Driven; no one needs to push you to excel; that’s just who you are
- Hungry to learn and actively look for opportunities to contribute
- Highly organized and detail-oriented; can handle multiple projects and dynamic priorities without missing a beat
Skills
ISO 27001, Soc 1/2, GRC, Isms, CCPA, GDPR, Vulnerability Management, Penetration Testing, Cloud Security, Risk Assessment
Similar jobs
Security Engineering jobs
Fluidstack
New York, NYThe Security Engineer will track advanced adversaries targeting frontier AI infrastructure, build intelligence pipelines, conduct threat hunts, and create production detections. The role requires hands-on malware and infrastructure analysis, production programming, and close collaboration with detection and incident response teams.
Figma
San Francisco, CASecurity Scientist analyzing attacker and user behavior, building data-driven detections, and leading security investigations and design reviews. Requires strong security and anti-abuse knowledge, SQL fluency, scripting proficiency, and experience with distributed data systems and statistical methods.
hud
San Francisco, CA
Own and build the company’s security program as its first full-time security hire, covering product, cloud, infrastructure, incident response, compliance, and customer trust. The role requires hands-on security engineering and incident leadership, with experience operating SOC 2 or comparable frameworks.
Stripe
United States
Conduct proactive threat hunting and adversary simulation to uncover financial fraud tactics, enrich threat intelligence, and improve platform controls. The role requires at least five years of relevant cybersecurity, abuse, or trust experience plus strong Python, SQL, investigative, and data-analysis skills.
Anthropic
San Francisco, CAConduct offensive security operations, red-team engagements, penetration testing, and adversarial simulations across cloud, endpoint, and bare-metal environments. The role requires at least five years of experience, strong engineering skills, and expertise across multiple security domains.