Staff Security Engineer

Responsibilities

• Maintain and mature the Information Security Management System (ISMS), including the Statement of Applicability (SoA), risk treatment plans, and Management Review Meeting (MRM) processes.
• Support ISO 27001 and SOC 2 Type 2 audits by determining scope, preparing evidence and narrative artifacts, participating in auditor interviews and walkthroughs, and resolving findings.
• Contribute to SOC 2 system descriptions and other audit documentation that accurately reflects the control environment.
• Track gaps and remediation efforts from readiness assessments and audits.
• Lead security policy creation, revision, and cross-functional review cycles.
• Support compliance scaling as additional products or business units pursue readiness assessments and certification.
• Support internal audits and ISO 27001 internal-audit requirements.
• Partner with Engineering, IT, Legal, Privacy, People teams, and product leadership to gather evidence, drive control ownership, and translate requirements into practical workflows.
• Advise Security leadership on audit risk, certification readiness, and compliance strategy.

Requirements

• 5 years of experience in information security, GRC, or compliance-focused roles.
• Deep familiarity with ISO 27001 and SOC 2 Trust Services Criteria, including meaningful participation in audits from readiness through certification.
• Experience across the breadth of an ISMS, including SoA maintenance, Management Review Meetings, and system-description authorship.
• Experience writing and revising security policies and leading cross-functional review cycles.
• Experience tracking gaps and remediation plans within broader compliance and risk programs.
• Strong cross-functional collaboration skills with engineers, product managers, legal stakeholders, and executives.
• Ability to translate compliance requirements into practical, actionable workflows.
• Ability to work independently, ramp quickly, and build processes where none exist.
• Strong written and verbal communication skills, including credibility with external auditors.

Nice to Have

• Relevant certifications such as CISA, CISSP, or ISO 27001 Lead Auditor/Implementer.

Compensation and Benefits

• Performance-based bonus plans for eligible employees.
• Medical, dental, and vision coverage.
• Retirement contributions with immediate vesting.
• Quarterly company wellness days.
• Country-specific holidays and a birthday day off.
• Home office stipend.
• Annual professional development budget.
• Quarterly well-being stipend.
• Paid parental leave.
• Employee referral bonus program.
• Additional benefits such as life and accidental death and dismemberment insurance, disability coverage, and an employee assistance program; benefits vary by country.