About this role
Security Lead
Job description: We are seeking an experienced GRC lead candidate with a strong background in compliance, security audits, privacy and risk management. The ideal candidate should have minimum 6+ years of relevant experience in compliance, security audits, privacy, business continuity and risk management. The ideal candidate should have strong hands-on experience in SOC 2 Type II and HITRUST r2 programs and should be comfortable working in a product development environment. This is a highly collaborative role requiring strong engagement with the CISO, engineering, product, cloud/infrastructure, privacy, legal, HR, internal audit, and business stakeholders. Key Responsibilities • Own and drive end-to-end SOC 2 Type II & HITRUST R2 compliance and certification programs, including readiness, control implementation, evidence management, remediation, and assessment activities. • Establish and maintain the organization's security compliance framework aligned with applicable regulatory and customer requirements. • Coordinate with external auditors, assessors, and certification bodies.
• Develop, maintain, and continuously improve security policies, standards, procedures, and control frameworks. • Perform security risk assessments and support enterprise and product-level risk management. Maintain risk registers, control matrices, compliance dashboards, and management reporting.
• Plan and execute periodic internal security audits. Identify gaps, risks, and opportunities for improvement. Work with stakeholders to develop remediation plans and track closure. Prepare the organization for external audits and customer security assessments.
• Partner with engineering and product teams to embed security and compliance requirements into the product development lifecycle. • Work closely with cloud, DevOps, application security, infrastructure, and engineering teams to ensure sustainable compliance.
• Own and drive the organization's security awareness program. Track awareness metrics and report program effectiveness to senior leadership.
• Lead cross-functional compliance initiatives and drive accountability for control owners. Present security compliance posture, risks, audit findings, and remediation status to senior management. • Demonstrate the ability to communicate complex security and compliance topics in a simple, business-oriented manner. Required Experience • 7–10 years of experience in Security Compliance, audits, privacy, business continuity and risk management.
• Strong hands-on experience in SOC 2 Type II & HITRUST implementation and audit management. • Experience conducting internal audits, control assessments, risk assessments, and compliance gap assessments. • Preferred: Experience working with product engineering / SaaS / technology organizations. • Ability to understand software development and cloud/product engineering environments. • Experience driving security awareness and security culture programs. • Demonstrated experience leading cross-functional initiatives and influencing senior stakeholders. • Exceptional communication and presentation skills.
Preferred Certifications Candidates with one or more of the following certifications are preferred: ISO 27001 Lead Auditor / Implementer, HITRUST Certified CSF Practitioner , CISA / CISM / CRISC.