Information Security Lead

Required

• 7+ years of information security experience, including experience operating ISO 27001 programs. Active CISSP certification, or eligibility and commitment to obtain it within six months of hire, is required; ISO 42001 and CGRC experience are preferred.
• Experience remediating security incidents, including practical experience building logging, monitoring, and detection capabilities.
• Ability to read and write code, ideally in Python and JavaScript/TypeScript, to identify potential attack paths, assess vulnerabilities, and recommend code-level fixes.
• Proficiency with infrastructure-as-code tools such as Pulumi or Terraform, cloud IAM, and deployment workflows.
• Knowledge of AI and agentic systems, with experience establishing practical security controls for their use.
• Experience serving as a foundational or sole information security owner is highly preferred.
• ISO 27001 and ISO 42001 operate on a continuous cadence, with current evidence, tested controls, reviewed risks, and corrective actions ready for surveillance audits.
• Security signals are centralized and actionable, incident procedures are rehearsed, investigations are handled with clear ownership, and lessons produce verified control improvements.
• Leadership receives a plain-language quarterly view of material risk, overdue remediation, control effectiveness, accepted exceptions, and the decisions or investment required.
• Privileged access is reviewed quarterly, identity lifecycle controls are auditable, critical vendors are assessed before receiving company data, and data-handling expectations are implemented in the systems that matter.
• Application and cloud findings have named engineering owners and deadlines, technical reviews happen early enough to change designs, and remediation is validated rather than closed on assertion.
• AI systems have a current inventory, defined owners and access boundaries, completed impact assessments, traceable activity, tested shutdown controls, and a prioritized plan for scaling the information security function.