We are seeking an experienced Senior Engineer - ServiceNow Platform with deep technical expertise in IT Service Management (ITSM), IT Asset Management (ITAM), Platform Integrations, Discovery. The ideal candidate will have proven experience designing, implementing, and managing complex ServiceNow platform solutions. This role will involve overall platform implementation, driving innovation, ensuring system optimization, and responsible for solution design for platform delivery. Ideal candidates demonstrate strong leadership skills to guide technical teams and business stakeholders.

Key Responsibilities:

• Platform Strategy:
• Lead the overall design of the ServiceNow platform, ensuring alignment with business goals and industry and technical best practices.
• Collaborate with business leaders, stakeholders, and technical teams to develop and implement innovative solutions using ServiceNow platform.
• Define platform roadmaps, by ensuring scalability, performance, stability, and audit compliance.
• Lead the design of workflows, integrations, and modules to extend the ServiceNow platform’s capabilities.
• ServiceNow Implementation & Optimization:
• Drive the end-to-end implementation of ServiceNow solutions, focusing on Core foundation, ITSM, ITAM, ITOM, SecOPs, GRC, TPRM, and other relevant modules.
• Manage platform upgrades and ensure all applications are optimized and adhere to enterprise security and compliance standards.
• Provide technical guidance to configure, customize, and develop on the ServiceNow platform based on business needs.
• Manage the documentation of solutions, internal technical and process knowledge base materials, and training of process owners and stakeholders.
• Leadership:
• Provide process governance and technical best practices.
• Providing mentorship and guidance for a team of ServiceNow engineers
• Work closely with cross-functional teams (IT, Security, Engineering, Finance, HR) to drive adoption and ensure platform success.
• The ability to meet strict deadlines and other targets both individually and as the leader of multiple teams, strong decision maker.
• Stakeholder Engagement & Communication:
• Engage with executive leadership and management to understand business objectives, providing solutions that deliver tangible value and measurable outcomes.
• Coordinate with ServiceNow team management to ensure clear communication regarding project status, challenges, and milestones.
• Continuous Improvement:
• Establish technical governance and best practices to continuously improve platform performance and operational efficiency.
• Stay current with the latest ServiceNow trends, releases, and best practices, proactively applying new technologies and functionalities to enhance the platform.
• Create a safe space for engineering team members to experiment with technical solutions that may solve organizational problems.

Required Qualifications:

• Experience:
• 8+ years of experience with ServiceNow, including deep technical expertise in ITSM, ITAM, ITOM, SecOPs, GRC, and TPRM modules.
• Strong experience in architecture and design of ServiceNow platform implementations, including workflows, custom apps, and integrations.
• Proven experience leading technical teams, process governance and delivering large-scale projects.

• Technical Skills:
• Proficiency with scripting languages (JavaScript, Glide, etc.) in the context of ServiceNow platform development and Service Portal (HTML, CSS, AngularJS, SASS, Bootstrap)
• Strong understanding of CMDB, Asset Management, Discovery, Portal, Incident, Problem, and Change Request Management processes.
• Experience integrating ServiceNow with external systems via REST/SOAP APIs, Integration Hub and Spokes.
• Nice to have Perl and Python programming in Linux environment.
• Experience with Agile, Scrum and Kanban development methodologies.

• Leadership & Communication:
• Demonstrated ability to mentor technical teams, ensuring a collaborative and high-performance culture.
• Excellent verbal and written communication skills, with the ability to present complex technical concepts to business leaders and stakeholders.

• Education/Certifications:
• Bachelor's degree in IT, Business, or related field preferred or equivalent work experience.
• ServiceNow Certified Implementation Specialist (ITSM, ITAM, or similar).
• ServiceNow Certified System Administrator (CSA).
• ServiceNow Certified Application Developer (CAD).
• ITIL v3/v4 certification is a plus.
• Certified Technical Architect (CTA) is a big plus.

This position is based in our Reston, VA office and offers a hybrid work schedule.

The pay range is $135,800- $183,800.

The anticipated annual base salary range for this position is noted above, however, base pay offered may vary depending on job-related knowledge, skills, experience. Verisign offers a discretionary bonus which is based on individual and company performance, and certain roles may be eligible for discretionary stock awards.

Engineering at Brex

Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders.

What you’ll do

As a Security Operations Engineer at Brex, you will focus on preventing, detecting and responding to security threats across Brex's corporate and cloud environments. You will use existing systems and develop tools to improve our security capabilities. Our team is responsible for functions across corporate security, detection & response and infrastructure security domains; and we perform systems engineering and automation to support those functions. 

Security Operations is part of our wider Trust & IT organization which means you will have the opportunity to work closely with Application Security, Corporate Engineering, GRC and IT and to improve security configurations, drive positive employee behaviors and generally work to prevent events from becoming incidents. You will also help build and maintain our team’s open source project Substation and have the opportunity to contribute to the Brex Tech Blog. You’ll be part of a team that actively contributes to the wider security community and has a commitment to mentorship and engineering excellence.

We’re looking for individuals with a strong background and interest in detecting, responding to, and resolving security incidents and security challenges. You should be comfortable dealing with lots of moving pieces, changing priorities, and new technologies, while having a keen eye for detail. Most importantly, you should be enthusiastic about working with a variety of backgrounds, roles, and people across Brex. Building a world-class financial service requires world-class security.

Where you’ll work

This role will be based in our San Francisco office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work!

Responsibilities

• Work on a highly cross-functional team to prevent, detect and respond to security threats across Brex's corporate and cloud environments
• Perform security incident response, investigation, remediation, and documentation, participate in periodic threat hunting and security exercises
• Leading, scoping and building features, participate in designing, and maintaining tools and systems which support the team’s domains – corporate security, detection & response and infrastructure security 
• Collaborating and partnering with engineering and operations teams to drive remediation of security issues, while balancing prioritization of those security issues within SLA and teams’ respective backlogs
• Caring about secure system design, valuing building things correctly, an understanding of a MVP approach and an empathetic mindset when working with others

Requirements

• Bachelor’s degree in Computer Science, Engineering or related field OR equivalent training / fellowship OR 5+ years work experienceExperience working in a corporate security, detection & response or infrastructure security role with responsibilities for security alert triage and security incident response 
• Familiarity with CI/CD systems and DevOps workflows (e.g. Buildkite, Flux, Git, Terraform) in cloud environments (e.g. AWS, Azure, GCP)
• Experience with deploying and maintaining some of the security services and tools owned by the team (e.g. - SIEM, data pipelines, SOAR, domain monitoring, endpoint tooling, email protection tooling, cloud security tools)
• While not primarily a development role, the team develops and maintains tools written in Go and Python, so experience with coding is required
• You thrive in a collaborative environment filled with a diverse group of people with different expertise and backgrounds. We currently have around 30 nationalities represented with more than ½ the company working in a country different from the one they grew up in.

Bonus points

• Proficiency with Go and other programming languages 
• Experience with securing distributed systems in AWS, cloud and Kubernetes environments
• Contributions to the wider technical community (open source, public research, mentorship, community organizing, blogging, presentations, etc)

Compensation

The expected salary range for this role is $192,000 - $240,000. However, the starting base pay will depend on a number of factors including the candidate’s location, skills, experience, market demands, and internal pay parity. Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package.

Brex LLC is a wholly owned subsidiary of Capital One, N.A.

Engineering

Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders.

What you’ll do

Brex’s Governance, Risk, and Compliance function is at an exciting and pivotal point in our maturity journey and we’re seeking a team member who can seamlessly bridge compliance expertise with technical execution. As a Senior GRC Engineer, you will drive critical GRC processes that mitigate risk, keep us compliant, and build trust with our customers and partners. You'll evolve the technical foundation of our Trust program by automating security controls, building integrations between security tools and GRC platforms, and creating scalable processes that enable Brex to maintain compliance efficiently as we expand into new markets. You'll work at the intersection of security, engineering, and compliance — translating regulatory requirements into technical solutions and building automation that eliminates manual toil.

You'll leverage your deep understanding of SOC 2, PCI DSS, ISO 27001, AI governance frameworks, and others to both design controls for emerging compliance requirements and mature existing programs through automation and continuous monitoring. You’ll support Trust Assurance, Third Party Risk Management, and other Security Risk Management initiatives. Working with our Engineering, Infrastructure, and Product teams, you'll translate compliance frameworks into technical controls and build automated systems that help us achieve world-class security as Brex expands.

Your contributions will directly accelerate Brex's maturity. You'll design workflows using Tines, build integrations between security and GRC systems, and create dashboards for security metrics. You'll implement controls across the technology stack, support multiple audits (SOC 2, PCI DSS, SOX/ITGC, FINRA, ISO), and contribute to AI governance framework implementation (ISO 42001, NIST AI RMF, EU AI Act).

You'll have autonomy to build innovative solutions, collaborating cross-functionally to implement controls that enable growth while communicating technical concepts effectively across the organization.

Where you’ll work

This role will be based in our Seattle office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work!

Responsibilities

• Manage and scale IT infrastructure, services and tooling
• Work with a diverse group of  IT partners to optimize our provided services
• Implement new services in support of Information Technologies vision
• Scale our services by implementing configuration as code via Terraform providers or APIs
• Operationalize and upskill IT and its partners by producing documentation and leading training sessions
• Evangelize best practices both internally and externally facing

Requirements

• 5+ years of experience in GRC, IT Governance, or Security Engineering with a strong track record of automating manual compliance workflows.
• Deep experience with security frameworks such as SOC 2, PCI DSS, ISO 27001, and NIST CSF, specifically within cloud-native environments.
• Technical proficiency in Python (or similar scripting languages) and experience building integrations using APIs to connect security tools with GRC systems. You can read code, design integrations, and understand technical implementations.
• Builder mindset with the ability to design and implement automated control testing, continuous monitoring, and data-driven security metrics. You see manual processes and immediately think about how to automate them.
• Exceptional cross-functional collaboration and communication skills. You can translate complex compliance requirements into technical specifications that engineering teams can actually implement and influence stakeholders across technical and non-technical domains.
• Strong systems thinking. You have the ability to design scalable GRC architectures that grow with the company, rather than just solving for the immediate audit.
• Bias for action. You’re a self-starter who ships solutions quickly and iterates based on feedback. 

Bonus points

• Previous experience in Fintech or banking environments navigating complex regulatory landscapes.
• Hands-on experience with Tines or other SOAR platforms to automate security operations.
• Familiarity with AI/ML governance frameworks (NIST AI RMF, ISO 42001) or securing agentic systems.
• Deep knowledge of Cloud Security (AWS/GCP), infrastructure-as-code (Terraform), or DevSecOps practices.
• Relevant industry certifications such as CISSP, CISA, or CCSP.
• Experience building metrics dashboards for security visualization and reporting.
• Active contributions to the GRC or Security community through open-source projects or public research.

Compensation

The expected salary range for this role is $153,600 - $192,000. However, the starting base pay will depend on a number of factors including the candidate’s location, skills, experience, market demands, and internal pay parity. Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package.

Brex LLC is a wholly owned subsidiary of Capital One, N.A.

Engineering

Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders.

What you’ll do

Brex’s Governance, Risk, and Compliance function is at an exciting and pivotal point in our maturity journey and we’re seeking a team member who can seamlessly bridge compliance expertise with technical execution. As a Senior GRC Engineer, you will drive critical GRC processes that mitigate risk, keep us compliant, and build trust with our customers and partners. You'll evolve the technical foundation of our Trust program by automating security controls, building integrations between security tools and GRC platforms, and creating scalable processes that enable Brex to maintain compliance efficiently as we expand into new markets. You'll work at the intersection of security, engineering, and compliance — translating regulatory requirements into technical solutions and building automation that eliminates manual toil.

You'll leverage your deep understanding of SOC 2, PCI DSS, ISO 27001, AI governance frameworks, and others to both design controls for emerging compliance requirements and mature existing programs through automation and continuous monitoring. You’ll support Trust Assurance, Third Party Risk Management, and other Security Risk Management initiatives. Working with our Engineering, Infrastructure, and Product teams, you'll translate compliance frameworks into technical controls and build automated systems that help us achieve world-class security as Brex expands.

Your contributions will directly accelerate Brex's maturity. You'll design workflows using Tines, build integrations between security and GRC systems, and create dashboards for security metrics. You'll implement controls across the technology stack, support multiple audits (SOC 2, PCI DSS, SOX/ITGC, FINRA, ISO), and contribute to AI governance framework implementation (ISO 42001, NIST AI RMF, EU AI Act).

You'll have autonomy to build innovative solutions, collaborating cross-functionally to implement controls that enable growth while communicating technical concepts effectively across the organization.

Where you’ll work

This role will be based in our New York office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work!

Responsibilities

• Manage and scale IT infrastructure, services and tooling
• Work with a diverse group of  IT partners to optimize our provided services
• Implement new services in support of Information Technologies vision
• Scale our services by implementing configuration as code via Terraform providers or APIs
• Operationalize and upskill IT and its partners by producing documentation and leading training sessions
• Evangelize best practices both internally and externally facing

Requirements

• 5+ years of experience in GRC, IT Governance, or Security Engineering with a strong track record of automating manual compliance workflows.
• Deep experience with security frameworks such as SOC 2, PCI DSS, ISO 27001, and NIST CSF, specifically within cloud-native environments.
• Technical proficiency in Python (or similar scripting languages) and experience building integrations using APIs to connect security tools with GRC systems. You can read code, design integrations, and understand technical implementations.
• Builder mindset with the ability to design and implement automated control testing, continuous monitoring, and data-driven security metrics. You see manual processes and immediately think about how to automate them.
• Exceptional cross-functional collaboration and communication skills. You can translate complex compliance requirements into technical specifications that engineering teams can actually implement and influence stakeholders across technical and non-technical domains.
• Strong systems thinking. You have the ability to design scalable GRC architectures that grow with the company, rather than just solving for the immediate audit.
• Bias for action. You’re a self-starter who ships solutions quickly and iterates based on feedback. 

Bonus points

• Previous experience in Fintech or banking environments navigating complex regulatory landscapes.
• Hands-on experience with Tines or other SOAR platforms to automate security operations.
• Familiarity with AI/ML governance frameworks (NIST AI RMF, ISO 42001) or securing agentic systems.
• Deep knowledge of Cloud Security (AWS/GCP), infrastructure-as-code (Terraform), or DevSecOps practices.
• Relevant industry certifications such as CISSP, CISA, or CCSP.
• Experience building metrics dashboards for security visualization and reporting.
• Active contributions to the GRC or Security community through open-source projects or public research.

Compensation

The expected salary range for this role is $153,600 - $192,000. However, the starting base pay will depend on a number of factors including the candidate’s location, skills, experience, market demands, and internal pay parity. Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package.

Brex LLC is a wholly owned subsidiary of Capital One, N.A.

Engineering

Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders.

What you’ll do

Brex’s Governance, Risk, and Compliance function is at an exciting and pivotal point in our maturity journey and we’re seeking a team member who can seamlessly bridge compliance expertise with technical execution. As a Senior GRC Engineer, you will drive critical GRC processes that mitigate risk, keep us compliant, and build trust with our customers and partners. You'll evolve the technical foundation of our Trust program by automating security controls, building integrations between security tools and GRC platforms, and creating scalable processes that enable Brex to maintain compliance efficiently as we expand into new markets. You'll work at the intersection of security, engineering, and compliance — translating regulatory requirements into technical solutions and building automation that eliminates manual toil.

You'll leverage your deep understanding of SOC 2, PCI DSS, ISO 27001, AI governance frameworks, and others to both design controls for emerging compliance requirements and mature existing programs through automation and continuous monitoring. You’ll support Trust Assurance, Third Party Risk Management, and other Security Risk Management initiatives. Working with our Engineering, Infrastructure, and Product teams, you'll translate compliance frameworks into technical controls and build automated systems that help us achieve world-class security as Brex expands.

Your contributions will directly accelerate Brex's maturity. You'll design workflows using Tines, build integrations between security and GRC systems, and create dashboards for security metrics. You'll implement controls across the technology stack, support multiple audits (SOC 2, PCI DSS, SOX/ITGC, FINRA, ISO), and contribute to AI governance framework implementation (ISO 42001, NIST AI RMF, EU AI Act).

You'll have autonomy to build innovative solutions, collaborating cross-functionally to implement controls that enable growth while communicating technical concepts effectively across the organization.

Where you’ll work

This role will be based in our San Francisco office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require a minimum of three coordinated days in the office per week, Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work!

Responsibilities

• Manage and scale IT infrastructure, services and tooling
• Work with a diverse group of  IT partners to optimize our provided services
• Implement new services in support of Information Technologies vision
• Scale our services by implementing configuration as code via Terraform providers or APIs
• Operationalize and upskill IT and its partners by producing documentation and leading training sessions
• Evangelize best practices both internally and externally facing

Requirements

• 5+ years of experience in GRC, IT Governance, or Security Engineering with a strong track record of automating manual compliance workflows.
• Deep experience with security frameworks such as SOC 2, PCI DSS, ISO 27001, and NIST CSF, specifically within cloud-native environments.
• Technical proficiency in Python (or similar scripting languages) and experience building integrations using APIs to connect security tools with GRC systems. You can read code, design integrations, and understand technical implementations.
• Builder mindset with the ability to design and implement automated control testing, continuous monitoring, and data-driven security metrics. You see manual processes and immediately think about how to automate them.
• Exceptional cross-functional collaboration and communication skills. You can translate complex compliance requirements into technical specifications that engineering teams can actually implement and influence stakeholders across technical and non-technical domains.
• Strong systems thinking. You have the ability to design scalable GRC architectures that grow with the company, rather than just solving for the immediate audit.
• Bias for action. You’re a self-starter who ships solutions quickly and iterates based on feedback. 

Bonus points

• Previous experience in Fintech or banking environments navigating complex regulatory landscapes.
• Hands-on experience with Tines or other SOAR platforms to automate security operations.
• Familiarity with AI/ML governance frameworks (NIST AI RMF, ISO 42001) or securing agentic systems.
• Deep knowledge of Cloud Security (AWS/GCP), infrastructure-as-code (Terraform), or DevSecOps practices.
• Relevant industry certifications such as CISSP, CISA, or CCSP.
• Experience building metrics dashboards for security visualization and reporting.
• Active contributions to the GRC or Security community through open-source projects or public research.

Compensation

The expected salary range for this role is $153,600 - $192,000. However, the starting base pay will depend on a number of factors including the candidate’s location, skills, experience, market demands, and internal pay parity. Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package.

Brex LLC is a wholly owned subsidiary of Capital One, N.A.

We are seeking a SAP Security & Platform Systems Engineer. This specialized role is responsible for the secure architecture and technical integration of our SAP S/4HANA RISE environment. The ideal candidate will bridge the gap between traditional SAP Security and modern Cloud Platform administration, ensuring robust, compliant, and well-connected SAP systems.

What You'll Do:

• SAP Security & Access Governance
  • Access Model Ownership: Design, build, and maintain S/4HANA business roles, Fiori catalogs, and authorization groups.
  • Identity Management: Perform configuration and troubleshooting of user provisioning and authentication workflows.
  • Compliance & Audit: Participate in technical efforts for SOX and ITGC audits, managing GRC/IAG (including SoD rulesets and Emergency Access/Firefighter) and providing technical evidence.
  • System and Data-Level Security: Perform vulnerability Assessment, secure Fiori apps/Web services and govern security measures at the CDS-view and OData service layer
• Platform Connectivity & System Administration
  • Cloud Ecosystem Integration: Design and manage technical trust configurations (SAML 2.0, OAuth 2.0, Principal Propagation) across S/4HANA, BTP, and SAP Analytics Cloud (SAC) etc.
  • BTP Management: Administer BTP subaccounts, service entitlements, and technical destinations.
  • Secure Connectivity: Install, configure, and monitor SAP Cloud Connectors to maintain secure data transfer between the RISE private cloud and BTP/external services.
  • Certificate Authority: Manage the full lifecycle of X.509 certificates and SSL handshakes within the entire SAP landscape.
  • RISE Coordination: Serve as the technical liaison with SAP RISE operations for system-level changes (e.g., refreshes, kernel parameters, OS configurations).

What You'll Need: 

• 10+ years in SAP technical roles, with a minimum of 3 years focused on S/4HANA and the Business Technology Platform (BTP).
• Expert proficiency in PFCG, SU24 optimization, and Fiori security architecture.
• Direct, practical experience with the SAP BTP Cockpit and SAP Cloud Connector.
• Proven ability to troubleshoot and manage Identity Protocols: SAML, OAuth2, and OpenID Connect (OIDC).
• Direct experience managing SOX/ITGC compliance requirements in a regulated or publicly traded company, reduce SOD violations
• Skilled in performing comprehensive end-to-end traces (e.g., ST01, browser traces, Cloud Connector logs) to diagnose connectivity and authorization issues. 
• Investigate and resolve Authorization-related issues, performing root cause analysis to prevent future breaches.
• Clear understanding of the SAP RISE shared responsibility model.

Please note that this job description is intended to provide a general overview of the position and does not include an exhaustive list of responsibilities and qualifications.

At Archer we aim to attract, retain, and motivate talent that possess the skills and leadership necessary to grow our business. We drive a pay-for-performance culture and reward performance that supports the Company’s business strategy. For this position we are targeting a base pay between $152,100 - $190,100. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience.

We are an equal-opportunity employer committed to creating a diverse and inclusive workplace. All qualified applicants will receive equal consideration for employment without regard to race, color, creed, religion, sex, gender identity, sexual orientation, national origin, disability, uniform service, Veteran status, age, or any other protected characteristic per federal, state, or local law, including those with a criminal history, in a manner consistent with the requirements of applicable state and local laws. 

By applying, you agree to be bound by our candidate privacy policy.

Archer is committed to working with and providing reasonable accommodations to job applicants with physical or mental disabilities, and those with sincerely held religious beliefs. Applicants who may require reasonable accommodation for any part of the application or hiring process should provide their name and contact information to Archer’s People Team at people@archer.com. Reasonable accommodations will be determined on a case-by-case basis.

Legend Biotech is seeking a Senior Manager, Internal Controls & Sustainability Reporting as part of the Finance team based in Bridgewater, NJ.

Role Overview

The Senior Manager, Internal Controls & Sustainability Reporting is responsible for executing the design, implementation, evaluation, and continuous improvement of the company’s internal control framework across financial reporting and select non‑financial reporting processes. This role plays a critical leadership position in ensuring compliance with SOX (404), managing enterprise-wide control assessments, partnering with business and IT leaders, and serving as a key liaison with Internal Audit and external auditors.
This role is critical to maintaining the integrity of the company’s reporting and supporting growth through strong governance and risk management. The Senior Manager, Internal Controls & Sustainability Reporting will also support the development and enhancement of sustainability reporting, and will have high visibility with finance leadership and the opportunity to meaningfully shape the internal control environment.
Prior experience with sustainability or ESG reporting is not required

Key Responsibilities

SOX & Internal Controls Leadership

• Drive the company’s SOX 404 compliance program end to end, including scoping, risk assessment, control design, testing strategy, remediation, and certification support.
• Evaluate the effectiveness of entity-level, process-level, and IT general controls (ITGCs).
• Support management’s assessment of internal controls over financial reporting (ICFR) and support quarterly and annual certifications.

Risk Assessment & Control Design

• Partner with process owners to identify financial reporting risks and design efficient, scalable controls.
• Assist in the standardization and optimization of controls, reducing redundancy while maintaining compliance.
• Assess the impact of new accounting standards, system implementations, acquisitions, and process changes on internal controls.

Audit & Stakeholder Management

• Coordinate walkthroughs, testing, issue resolution, and audit deliverables, proactively managing timelines and risks to prevent delays.
• Support the remediation of control deficiencies, including significant deficiencies and material weaknesses.
• Track control deficiencies, lead root cause analysis, and oversee remediation efforts through closure.

Process Improvement & Governance

• Support continuous improvement initiatives, including automation and use of governance, risk, and compliance (GRC) tools.
• Support broader GRC initiatives as needed.
• Assist with special projects for the Controller or CFO, including M&A integration and transformation initiatives.

Operational Audits

• Track and drive closure of operational audit deficiencies impacting the finance function, including follow‑up and remediation oversight.
• Collaborate with operational managers to design and implement effective controls to mitigate identified deficiencies.
• Modify policies, procedures, and internal control documentation to reflect corrected processes.
• If necessary, provide training to staff on updated processes and strengthen the overall control culture.

Sustainability Reporting (expected to be 25-50% of role)

• Support sustainability reporting processes aligned with global regulatory frameworks to promote accuracy, completeness, and assurance readiness.
• Assist with the development and maintenance of internal control frameworks over sustainability data.

Requirements

• Bachelor’s degree in Accounting, Finance, or related field.
• 7+ years of progressive experience in internal controls, SOX, public accounting, or a combination thereof. Big 4 or national public accounting firm experience a plus.
• Strong knowledge of COSO framework and exposure to IT general controls and automated control environments.
• Exposure to automation, data analytics, and/or AI‑enabled tools is a plus.
• ESG or Sustainability reporting experience preferred, not essential.
• CPA a plus.
• Knowledge of IFRS a plus.

#Li-LB1

#Li-Hybrid

The Strategic Account Director position is responsible for developing and managing Accounts designated as Global Accounts and maximizing all sales opportunities within those accounts. More specifically, this position will be charged with promoting and selling KnowBe4’s products and services, with the objective to achieve and exceed monthly sales quota. This can be achieved by targeting your book of business and maximizing cross sale opportunities, increasing subscription levels and adding on additional seats due to account growth. This role will work closely with the assigned customer account teams including the Customer Success Manager and other Account Executives/Managers as necessary to ensure increased ARR and more product suite adoption and coordinate any territory specific deals relating to their global accounts.

Responsibilities:

• Promote and sell KnowBe4’s range of products and services.
• Build and maintain a pipeline of potential customers by developing and managing relationships with prospects.
• Build and maintain a pipeline of potential cross sale, add-on and upgrade opportunities by developing and managing relationships with your assigned customer accounts.
• Identify key decision makers and develop meaningful relationships that add value and drive future account growth. 
• Articulate the value proposition of KnowBe4’s full suite of products and help the customer understand how it will improve their business’s security awareness training (and security overall).
• Achieve or exceed monthly quotas and/or targets. 
• Be well versed in KnowBe4’s product offerings and promote the products and services at trade shows as requested.
• Follow up on marketing leads to generate sales opportunities and pipeline.
• Act strategically in offering or negotiating discounted pricing, in line with established policies and procedures.
• Maintain accurate and thorough records for customer calls, emails, notes, tasks, demos and other relevant information in compliance with the Administration Policy.
• Support in the renewal process where there is an opportunity to grow the account.
• Work with those Customer Success Managers and Renewal Specialists assigned to your customer accounts to the end of your customers increasing their commitment and use of the KnowBe4 Product Suite. 
• Partner with KnowBe4 Revenue teams on methods/ strategies to achieve increased account penetration of Global accounts.  
• Global Account Mapping.
• Traveling to meet on-site with C-Levels and other Executives for their assigned accounts.

Minimum Qualifications:

• Bachelor's Degree strongly preferred (exceptions may be made for military experience). Degree in any field acceptable, but a plus if Cybersecurity, Computer Science, IT, Business, Marketing. 
• Proven track record selling to EVP and C-level (CISOs and Security Teams a plus)
• 5+ years SaaS sales experience (Cybersecurity preferred but not required)
• Experience selling deals $100K - $200K in the Enterprise segment
• Experience selling multi-year deals
• International: English and local language proficiency required.
• Has demonstrated expertise in value-based selling methodologies with enterprise accounts
• Executive-level presentation and communication skills 
• Experience with strategic account planning and management showing measurable account growth
• Experience managing and progressing opportunities involving multiple stakeholders
• Has a track record of managing and closing complex, multi-year deals with multiple stakeholders
• Experience creating and communicating compelling business cases 
• Experience with consultative selling approach and value selling methodology
• Experience handling technical objections
• Skilled in running discovery conversations and managing tailored product demonstrations 
• Technical aptitude with experience using sales tools 
• Experience with CRM systems (preferably Salesforce)
• Experienced with pipeline management & accurate forecasting
• Familiarity with standard concepts, practices and procedures within the IT Security Field
• Experience with Salesforce and Gmail
• Network or Security Plus preferred
• Achievement in demanding extracurricular activities (e.g., debate team captain, entrepreneurial ventures)
• Self-motivated with a growth mindset and continuous learning orientation 
• Strong competitive spirit balanced with collaborative approach 
• Demonstrated interest in cybersecurity sales
• Consistently positive attitude even in the face of adversity
• Quick learner with strong listening skills
• Strong written and verbal communication skills, with previous presentation experience
• Excellent phone presence and professional demeanor 
• Time management and organizational skills 
• Ability to handle rejection and maintain persistence
• Stats driven business professional
• Motivated, energetic self-starter
• Strong collaborative and teamwork skills
• Must be able to work with minimum supervision
• General understanding of:
• Human Risk Management & challenges faced by IT / InfoSec Teams / Compliance & Board Members
• Basic network and email security concepts
• SIEM/SOAR platforms
• Zero Trust Architecture
• Cloud security architecture
• Phishing attack vectors 
• Identity & Access Management 
• Security orchestration and automation
• General understanding of Security Technology Stack: 
• Enterprise IAM solutions (Okta, Ping, Azure AD) 
• SIEM platforms (Splunk, QRadar, LogRhythm) 
• EDR platforms (CrowdStrike, Carbon Black, SentinelOne) 
• Cloud security (AWS Security Hub, Azure Security Center) 
• Email security solutions 
• GRC platforms
• Genuine curiosity and strong desire to learn about cybersecurity and technical concepts
• Basic computer literacy and comfort with business applications
• Ability to quickly grasp and explain basic technical concepts
• Ability to translate complex topics into simple terms
• Interest in keeping up with current technology and cybersecurity trends
• Proven track record of grit and resilience in challenging situations, with high performance under pressure 
• Collegiate athlete or competitive sports background demonstrating rigorous discipline, teamwork, dedication, and competitive spirit
• History of setting and achieving ambitious personal or professional goals
• Track record of leadership in team settings

The compensation for this position ranges from $250,000-$270,000 including base, bonuses and commissions. For more details, click here www.know www.knowbe4.com/careers/know-your-pay/enterprise-sales

The Strategic Account Director position is responsible for developing and managing Accounts designated as Global Accounts and maximizing all sales opportunities within those accounts. More specifically, this position will be charged with promoting and selling KnowBe4’s products and services, with the objective to achieve and exceed monthly sales quota. This can be achieved by targeting your book of business and maximizing cross sale opportunities, increasing subscription levels and adding on additional seats due to account growth. This role will work closely with the assigned customer account teams including the Customer Success Manager and other Account Executives/Managers as necessary to ensure increased ARR and more product suite adoption and coordinate any territory specific deals relating to their global accounts.

Responsibilities:

• Promote and sell KnowBe4’s range of products and services.
• Build and maintain a pipeline of potential customers by developing and managing relationships with prospects.
• Build and maintain a pipeline of potential cross sale, add-on and upgrade opportunities by developing and managing relationships with your assigned customer accounts.
• Identify key decision makers and develop meaningful relationships that add value and drive future account growth. 
• Articulate the value proposition of KnowBe4’s full suite of products and help the customer understand how it will improve their business’s security awareness training (and security overall).
• Achieve or exceed monthly quotas and/or targets. 
• Be well versed in KnowBe4’s product offerings and promote the products and services at trade shows as requested.
• Follow up on marketing leads to generate sales opportunities and pipeline.
• Act strategically in offering or negotiating discounted pricing, in line with established policies and procedures.
• Maintain accurate and thorough records for customer calls, emails, notes, tasks, demos and other relevant information in compliance with the Administration Policy.
• Support in the renewal process where there is an opportunity to grow the account.
• Work with those Customer Success Managers and Renewal Specialists assigned to your customer accounts to the end of your customers increasing their commitment and use of the KnowBe4 Product Suite. 
• Partner with KnowBe4 Revenue teams on methods/ strategies to achieve increased account penetration of Global accounts.  
• Global Account Mapping.
• Traveling to meet on-site with C-Levels and other Executives for their assigned accounts.

Minimum Qualifications:

• Bachelor's Degree strongly preferred (exceptions may be made for military experience). Degree in any field acceptable, but a plus if Cybersecurity, Computer Science, IT, Business, Marketing. 
• Proven track record selling to EVP and C-level (CISOs and Security Teams a plus)
• 5+ years SaaS sales experience (Cybersecurity preferred but not required)
• Experience selling deals $100K - $200K in the Enterprise segment
• Experience selling multi-year deals
• International: English and local language proficiency required.
• Has demonstrated expertise in value-based selling methodologies with enterprise accounts
• Executive-level presentation and communication skills 
• Experience with strategic account planning and management showing measurable account growth
• Experience managing and progressing opportunities involving multiple stakeholders
• Has a track record of managing and closing complex, multi-year deals with multiple stakeholders
• Experience creating and communicating compelling business cases 
• Experience with consultative selling approach and value selling methodology
• Experience handling technical objections
• Skilled in running discovery conversations and managing tailored product demonstrations 
• Technical aptitude with experience using sales tools 
• Experience with CRM systems (preferably Salesforce)
• Experienced with pipeline management & accurate forecasting
• Familiarity with standard concepts, practices and procedures within the IT Security Field
• Experience with Salesforce and Gmail
• Network or Security Plus preferred
• Achievement in demanding extracurricular activities (e.g., debate team captain, entrepreneurial ventures)
• Self-motivated with a growth mindset and continuous learning orientation 
• Strong competitive spirit balanced with collaborative approach 
• Demonstrated interest in cybersecurity sales
• Consistently positive attitude even in the face of adversity
• Quick learner with strong listening skills
• Strong written and verbal communication skills, with previous presentation experience
• Excellent phone presence and professional demeanor 
• Time management and organizational skills 
• Ability to handle rejection and maintain persistence
• Stats driven business professional
• Motivated, energetic self-starter
• Strong collaborative and teamwork skills
• Must be able to work with minimum supervision
• General understanding of:
• Human Risk Management & challenges faced by IT / InfoSec Teams / Compliance & Board Members
• Basic network and email security concepts
• SIEM/SOAR platforms
• Zero Trust Architecture
• Cloud security architecture
• Phishing attack vectors 
• Identity & Access Management 
• Security orchestration and automation
• General understanding of Security Technology Stack: 
• Enterprise IAM solutions (Okta, Ping, Azure AD) 
• SIEM platforms (Splunk, QRadar, LogRhythm) 
• EDR platforms (CrowdStrike, Carbon Black, SentinelOne) 
• Cloud security (AWS Security Hub, Azure Security Center) 
• Email security solutions 
• GRC platforms
• Genuine curiosity and strong desire to learn about cybersecurity and technical concepts
• Basic computer literacy and comfort with business applications
• Ability to quickly grasp and explain basic technical concepts
• Ability to translate complex topics into simple terms
• Interest in keeping up with current technology and cybersecurity trends
• Proven track record of grit and resilience in challenging situations, with high performance under pressure 
• Collegiate athlete or competitive sports background demonstrating rigorous discipline, teamwork, dedication, and competitive spirit
• History of setting and achieving ambitious personal or professional goals
• Track record of leadership in team settings

Clearwater positions open to candidates located in greater Tampa Bay area.

The Account Manager (Enterprise/Strategic) position is responsible for managing assigned customer accounts and maximizing all sales opportunities within those accounts. More specifically, this position will be charged with promoting and selling KnowBe4’s additional products and services to businesses (organizations with 1501+ employees), with the objective to achieve and exceed monthly sales quota. This can be achieved by targeting your book of business and maximizing cross sale opportunities, increasing subscription levels and adding on additional seats due to account growth. This role will work closely with the Customer Success Manager to ensure increased ARR and more product suite adoption by our customers.

Responsibilities:

• Promote and sell KnowBe4’s range of products and services
• Build and maintain a pipeline of potential cross sale, add-on and upgrade opportunities by developing and managing relationships with your assigned accounts
• Identify key decision makers while developing and qualifying cross sale, add-on and upgrade opportunities
• Articulate the value proposition of KnowBe4’s full suite of products and help the customer understand how it will improve their business’s security awareness training (and security overall)
• Achieve or exceed monthly quotas and/or targets 
• Be well versed in KnowBe4’s product offerings and promote the products and services at trade shows as requested
• Follow up on marketing leads to generate sales opportunities and pipeline
• Act strategically in offering or negotiating discounted pricing, in line with established policies and procedures
• Maintain accurate and thorough records for customer calls, emails, notes, tasks, demos and other relevant information in compliance with the Administration Policy
• Support in the renewal process where there is an opportunity to grow the account
• Work with those Customer Success Managers and Renewal Specialists assigned to your customer accounts to the end of your customers increasing their commitment and use of the Knowbe4 Product Suite

Minimum Qualifications:

• Bachelor's Degree strongly preferred (exceptions may be made for military experience). Degree in any field acceptable, but a plus if Cybersecurity, Computer Science, IT, Business, Marketing.
• Proven track record selling to EVP and C-level (CISOs and Security Teams a plus)
• 5+ years SaaS sales experience (Cybersecurity preferred but not required)
• Experience selling deals $500K+ in the Enterprise segment
• Experience selling multi-year deals
• International: English and local language proficiency required.
• Has demonstrated expertise in value-based selling methodologies with enterprise accounts
• Executive-level presentation and communication skills 
• Experience with strategic account planning and management showing measurable account growth
• Experience managing and progressing opportunities involving multiple stakeholders
• Has a track record of managing and closing complex, multi-year deals with multiple stakeholders
• Experience creating and communicating compelling business cases 
• Experience with consultative selling approach and value selling methodology
• Experience handling technical objections
• Skilled in running discovery conversations and managing tailored product demonstrations 
• Technical aptitude with experience using sales tools 
• Experience with CRM systems (preferably Salesforce)
• Experienced with pipeline management & accurate forecasting
• Familiarity with standard concepts, practices and procedures within the IT Security Field
• Experience with Salesforce and Gmail
• Network or Security Plus preferred
• Proven track record of grit and resilience in challenging situations, with high performance under pressure 
• Collegiate athlete or competitive sports background demonstrating rigorous discipline, teamwork, dedication, and competitive spirit
• History of setting and achieving ambitious personal or professional goals
• Track record of leadership in team settings
• Demonstrated interest in cybersecurity sales
• Quick learner with strong listening skills
• Strong written and verbal communication skills, with previous presentation experience
• Excellent phone presence and professional demeanor 
• Time management and organizational skills 
• Ability to handle rejection and maintain persistence
• Stats driven business professional
• Motivated, energetic self-starter
• Strong collaborative and teamwork skills
• Must be able to work with minimum supervision
• Must have a General understanding of:
  • Human Risk Management & challenges faced by IT / InfoSec Teams / Compliance & Board Members
  • Basic network and email security concepts
  • SIEM/SOAR platforms
  • Zero Trust Architecture
  • Cloud security architecture
  • Phishing attack vectors 
  • Identity & Access Management 
  • Security orchestration and automation
• General understanding of Security Technology Stack:
  • Enterprise IAM solutions (Okta, Ping, Azure AD) 
  • SIEM platforms (Splunk, QRadar, LogRhythm) 
  • EDR platforms (CrowdStrike, Carbon Black, SentinelOne) 
  • Cloud security (AWS Security Hub, Azure Security Center) 
  • Email security solutions 
  • GRC platforms
• Genuine curiosity and strong desire to learn about cybersecurity and technical concepts
• Basic computer literacy and comfort with business applications
• Ability to quickly grasp and explain basic technical concepts
• Ability to translate complex topics into simple terms
• Interest in keeping up with current technology and cybersecurity trends
• Proven track record of grit and resilience in challenging situations, with high performance under pressure 
• Collegiate athlete or competitive sports background demonstrating rigorous discipline, teamwork, dedication, and competitive spirit
• History of setting and achieving ambitious personal or professional goals
• Track record of leadership in team settings

New York positions open to candidates located in the New York area.

The Account Manager (Enterprise/Strategic) position is responsible for managing assigned customer accounts and maximizing all sales opportunities within those accounts. More specifically, this position will be charged with promoting and selling KnowBe4’s additional products and services to businesses (organizations with 1501+ employees), with the objective to achieve and exceed monthly sales quota. This can be achieved by targeting your book of business and maximizing cross sale opportunities, increasing subscription levels and adding on additional seats due to account growth. This role will work closely with the Customer Success Manager to ensure increased ARR and more product suite adoption by our customers.

Responsibilities:

• Promote and sell KnowBe4’s range of products and services
• Build and maintain a pipeline of potential cross sale, add-on and upgrade opportunities by developing and managing relationships with your assigned accounts
• Identify key decision makers while developing and qualifying cross sale, add-on and upgrade opportunities
• Articulate the value proposition of KnowBe4’s full suite of products and help the customer understand how it will improve their business’s security awareness training (and security overall)
• Achieve or exceed monthly quotas and/or targets 
• Be well versed in KnowBe4’s product offerings and promote the products and services at trade shows as requested
• Follow up on marketing leads to generate sales opportunities and pipeline
• Act strategically in offering or negotiating discounted pricing, in line with established policies and procedures
• Maintain accurate and thorough records for customer calls, emails, notes, tasks, demos and other relevant information in compliance with the Administration Policy
• Support in the renewal process where there is an opportunity to grow the account
• Work with those Customer Success Managers and Renewal Specialists assigned to your customer accounts to the end of your customers increasing their commitment and use of the Knowbe4 Product Suite

Minimum Qualifications:

• Bachelor's Degree strongly preferred (exceptions may be made for military experience). Degree in any field acceptable, but a plus if Cybersecurity, Computer Science, IT, Business, Marketing.
• Proven track record selling to EVP and C-level (CISOs and Security Teams a plus)
• 5+ years SaaS sales experience (Cybersecurity preferred but not required)
• Experience selling deals $500K+ in the Enterprise segment
• Experience selling multi-year deals
• International: English and local language proficiency required.
• Has demonstrated expertise in value-based selling methodologies with enterprise accounts
• Executive-level presentation and communication skills 
• Experience with strategic account planning and management showing measurable account growth
• Experience managing and progressing opportunities involving multiple stakeholders
• Has a track record of managing and closing complex, multi-year deals with multiple stakeholders
• Experience creating and communicating compelling business cases 
• Experience with consultative selling approach and value selling methodology
• Experience handling technical objections
• Skilled in running discovery conversations and managing tailored product demonstrations 
• Technical aptitude with experience using sales tools 
• Experience with CRM systems (preferably Salesforce)
• Experienced with pipeline management & accurate forecasting
• Familiarity with standard concepts, practices and procedures within the IT Security Field
• Experience with Salesforce and Gmail
• Network or Security Plus preferred
• Proven track record of grit and resilience in challenging situations, with high performance under pressure 
• Collegiate athlete or competitive sports background demonstrating rigorous discipline, teamwork, dedication, and competitive spirit
• History of setting and achieving ambitious personal or professional goals
• Track record of leadership in team settings
• Demonstrated interest in cybersecurity sales
• Quick learner with strong listening skills
• Strong written and verbal communication skills, with previous presentation experience
• Excellent phone presence and professional demeanor 
• Time management and organizational skills 
• Ability to handle rejection and maintain persistence
• Stats driven business professional
• Motivated, energetic self-starter
• Strong collaborative and teamwork skills
• Must be able to work with minimum supervision
• Must have a General understanding of:
  • Human Risk Management & challenges faced by IT / InfoSec Teams / Compliance & Board Members
  • Basic network and email security concepts
  • SIEM/SOAR platforms
  • Zero Trust Architecture
  • Cloud security architecture
  • Phishing attack vectors 
  • Identity & Access Management 
  • Security orchestration and automation
• General understanding of Security Technology Stack:
  • Enterprise IAM solutions (Okta, Ping, Azure AD) 
  • SIEM platforms (Splunk, QRadar, LogRhythm) 
  • EDR platforms (CrowdStrike, Carbon Black, SentinelOne) 
  • Cloud security (AWS Security Hub, Azure Security Center) 
  • Email security solutions 
  • GRC platforms
• Genuine curiosity and strong desire to learn about cybersecurity and technical concepts
• Basic computer literacy and comfort with business applications
• Ability to quickly grasp and explain basic technical concepts
• Ability to translate complex topics into simple terms
• Interest in keeping up with current technology and cybersecurity trends
• Proven track record of grit and resilience in challenging situations, with high performance under pressure 
• Collegiate athlete or competitive sports background demonstrating rigorous discipline, teamwork, dedication, and competitive spirit
• History of setting and achieving ambitious personal or professional goals
• Track record of leadership in team settings

The compensation for this position ranges from $200,000-$210,000 including base, bonuses and commissions. For more details, click here www.know www.knowbe4.com/careers/know-your-pay/enterprise-sales

We will accept applications until 2/27/2026.

Description:

The Information Security Risk Analyst is the operational engine of the internal risk program. While the Senior IRM Analyst and Risk Director define the strategic roadmap, the Analyst ensures the daily execution of that strategy. They are responsible for the "production line" of risk assessment: taking raw signals from the business, processing them through the established methodology, and outputting actionable risk decisions (Remediation or Acceptance).

The ultimate objective of this role is Reduction of Uncertainty. By managing the program effectively, the IRM Analyst ensures that MongoDB’s leadership has a clear, quantified view of the top risks facing the enterprise. They transform the Risk Register from a static spreadsheet into a dynamic governance tool that drives accountability.

The IRM Analyst must not be afraid to be in the trenches with the Engineering and Product teams. They are the primary face of the "Risk Intake Process," guiding stakeholders through the methodology. They are the gatekeeper of quality, ensuring that no risk enters the register until it has been properly scoped and quantified.

Responsibilities:

Risk Identification & Assessment

• Execute risk assessments under senior guidance - perform scoping, inherent risk scoring, control assessment, and residual risk calculation using established methodology
• Conduct risk identification intake, manage the flow of requests from Jira Service Desk and the Issue Intake Tracker, review incoming submissions against entry criteria, assign Risk IDs, and replicate validated risks into the Risk Register
• Act as the Triage Officer for incoming risk submissions, determine whether submissions represent strategic risks, operational issues, or duplicates. Filter noise to focus the team on signals
• Develop risk scenarios for in-scope assets by working with asset owners and risk owners , identify threat communities, threat events, and impact categories
• Draft Risk Assessment Memos that tell a cohesive story from risk statement to risk rating to actionable recommendation. Progressively build toward independently authored memos that require minimal review notes
• Monitor and flag emerging risk signals , including AI-related risks (model integrity, data poisoning, shadow AI, third-party AI dependencies) , and escalate with documented analysis for integration into the risk framework

Control Identification, Mapping & Assessment

• Identify and document controls that mitigate assessed risks , map controls to specific risk scenarios and applicable framework requirements (NIST SP 800-53, ISO 27001, SOC 2)
• Assess the design adequacy of controls , evaluate whether each control is appropriately designed to address the risk it is mapped to, and document findings with supporting rationale
• Assess the operating effectiveness of controls , collect and evaluate evidence to determine whether controls are functioning as designed over the assessment period, and document results
• Document control gaps and support remediation tracking , maintain clear records of where controls are missing, partially effective, or require compensating controls. Track remediation progress
• Maintain control-to-framework mappings to ensure risk assessment outputs directly support audit and certification evidence packages (FedRAMP, SOC 2, ISO 27001, PCI-DSS)

Risk Categorization & Governance

• Apply the established risk taxonomy and categorization methodology consistently across all assessed risks
• Process risk acceptance requests in Jira , validate completeness, ensure documented context and stakeholder sign-off, confirm time-bound conditions, and flag concerns to the Senior lead
• Maintain the Risk Register, risk inventory, and supporting trackers with obsessive attention to data integrity, no missing dates, undefined owners, or stale entries. A Risk Register with governance gaps is a program failure

Reporting & Stakeholder Engagement

• Contribute to KRI data collection and dashboard inputs , support accurate, timely reporting that feeds executive risk dashboards and governance forum materials
• Engage directly with technical stakeholders (engineering, product, infrastructure teams) during risk assessments , ask informed questions, gather evidence, and document findings
• Progressively build the technical fluency to lead stakeholder conversations independently , develop working proficiency in cloud-native architectures, SaaS security models, and common technical controls (IAM, encryption, network segmentation, logging/monitoring)
• Translate technical findings into clear, business-relevant risk language in all written work products

Policy, Process & Governance Hygiene

• Support drafting and maintaining risk procedures, guidelines, and assessment templates across the IRM program scope
• Execute governance hygiene , data quality, tracker maintenance, workflow adherence, evidence organization, and documentation standards
• Manage the risk assessment pipeline in Jira, create and maintain workflows, dashboards, and use JQL to track the assessment ticket lifecycle

Requirements:

Experience & Education:

• 3–5 years of experience in Information Security, Governance, Risk, and Compliance (GRC), or Enterprise Risk Management
• Experience performing risk assessments — including risk identification, inherent/residual risk scoring, and documentation of findings
• Experience identifying, documenting, and evaluating controls — including assessment of design adequacy and operating effectiveness
• Strong working knowledge of NIST CSF, NIST SP 800-30/39/53, and ISO/IEC 27005 — ability to use these frameworks as a library of controls and risk guidance
• Advanced proficiency in Excel/Google Sheets (pivot tables, VLOOKUP, complex formulas) for risk data analysis and reporting
• Jira proficiency — managing projects, creating workflows and dashboards, and using JQL
• Ability to write clear, concise, and defensible Risk Assessment Memos
• Obsessive attention to detail regarding data integrity and documentation quality
• Foundational understanding of cloud-native architectures and common technical controls (IAM, encryption, logging/monitoring, network segmentation) — with a commitment to building deeper technical fluency
• Awareness of AI risk concepts and willingness to develop expertise in emerging AI risk and regulatory landscape
• A strong track record of collaborating effectively across teams and levels
• Bachelor's degree in Cybersecurity, Information Systems, Business Administration, or a related field
• Certifications: At least, one of the following certifications is required - CRISC, CISM, CISSP, or CISA

About MongoDB

MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the database for the AI era, enabling innovators to create, transform, and disrupt industries with software. MongoDB’s unified database platform, the most widely available, globally distributed database on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud database and is available across AWS, Google Cloud, and Microsoft Azure.

With offices worldwide and over 60,000 customers, including 75% of the Fortune 100 and AI-native startups, relying on MongoDB for their most important applications, we’re powering the next era of software.

Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It’s what makes us MongoDB. 

To drive the personal growth and business impact of our employees, we’re committed to developing a supportive and enriching culture for everyone. From employee affinity groups, to fertility assistance and a generous parental leave policy, we value our employees’ wellbeing and want to support them along every step of their professional and personal journeys. Learn more about what it’s like to work at MongoDB, and help us make an impact on the world!

MongoDB is committed to providing any necessary accommodations for individuals with disabilities within our application and interview process. To request an accommodation due to a disability, please inform your recruiter.

MongoDB, Inc. provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type and makes all hiring decisions without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

Req ID: 1273425625

The Program Manager / Senior Analyst (Public Sector) is a senior-level individual contributor role responsible for the lifecycle management of our most sensitive US government authorizations. This role acts as a lead for high-stakes workstreams involving FedRAMP High, DoD IL5+, CJIS, and ITAR. Unlike the Analyst level, this role takes full ownership of complex federal assessments and leads the continuous monitoring strategy for our Atlas for Government product. This role is a key resource for interpreting NIST 800-53 controls and translating them into technical requirements for our engineering teams.

Responsibilities:

• Lead the end-to-end execution of federal assessments, coordinating with Third Party Assessment Organizations (3PAOs), agency sponsors, and the FedRAMP PMO
• Manage the federal continuous monitoring (ConMon) program, including the timely analysis and reporting of vulnerabilities and the maintenance of the POA&M
• Lead the annual update and technical review of core FedRAMP artifacts, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP)
• Act as a technical advisor to Engineering and Operations teams to ensure cloud configurations (e.g., FIPS 140-2/140-3, boundary protection, and access control) meet federal and DoD IL5+ mandates
• Perform deep-dive gap analyses for new public sector requirements (such as CMMC or GovRAMP) and define the roadmap for technical remediation
• Directly support federal sales efforts by serving as a subject matter expert during customer security reviews and explaining our technical compliance posture to agency stakeholders
• Create and maintain high-impact Jira dashboards and presentations to provide leadership with visibility into public sector compliance health and project milestones

Requirements:

• 5+ years in GRC, Technical Writing, or IT Audit, with a heavy focus on US Public Sector frameworks (FedRAMP, DoD SRG, CJIS)
• Deep understanding of NIST 800-53 and NIST 800-171 controls and how they are implemented within cloud architectures (AWS, GCP, or Azure)
• Proven track record of managing federal audits from kickoff through to the issuance of an Authorization to Operate (ATO)
• Exceptional ability to explain complex security configurations to government auditors and internal technical teams
• Advanced proficiency in Jira and Confluence to track control performance data and manage large-scale federal documentation projects
• US Citizenship is required for this role.

Responsibilities & Expectations:

• You are expected to be the primary driver of public sector compliance initiatives
• You move beyond simple task tracking to understand the intent behind federal requirements, ensuring our technical implementation is both compliant and efficient
• You are expected to maintain the highest level of confidentiality and integrity due to the sensitivity of government data

Scope & Complexity:

• The scope is deeply technical and specialized for the US Federal, State, and Local Government markets
• You will navigate the complexity of mapping shared controls across multiple specialized frameworks, ensuring a single remediation effort satisfies FedRAMP, CJIS, and ITAR requirements simultaneously

Authority & Impact:

• This role has the authority to lead federal assessment project streams and represent MongoDB in technical reviews with 3PAOs and federal agencies
• Your work directly enables MongoDB to secure and maintain the authorizations required to serve the Department of Defense and civilian agencies, protecting a critical revenue stream

Expertise:

• You will be recognized as a subject matter expert in public sector cloud security requirements and their implementation in SaaS environments
• You bridge the gap between high-level policy and technical engineering, becoming the go-to resource for how MongoDB Atlas for Government meets the most stringent federal mandates

Leadership:

• Leadership in this role is demonstrated through technical ownership and mentorship. You will lead cross-functional project teams through intense authorization cycles and mentor junior analysts on the nuances of NIST 800-53 and federal audit methodology

About MongoDB

MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the database for the AI era, enabling innovators to create, transform, and disrupt industries with software. MongoDB’s unified database platform, the most widely available, globally distributed database on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud database and is available across AWS, Google Cloud, and Microsoft Azure.

With offices worldwide and over 60,000 customers, including 75% of the Fortune 100 and AI-native startups, relying on MongoDB for their most important applications, we’re powering the next era of software.

Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It’s what makes us MongoDB. 

To drive the personal growth and business impact of our employees, we’re committed to developing a supportive and enriching culture for everyone. From employee affinity groups, to fertility assistance and a generous parental leave policy, we value our employees’ wellbeing and want to support them along every step of their professional and personal journeys. Learn more about what it’s like to work at MongoDB, and help us make an impact on the world!

MongoDB is committed to providing any necessary accommodations for individuals with disabilities within our application and interview process. To request an accommodation due to a disability, please inform your recruiter.

MongoDB, Inc. provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type and makes all hiring decisions without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

Req ID: 1273396370

The Compliance team at MongoDB manages the strategy, execution, and maintenance of our global security certifications and regulatory requirements. We ensure that our cloud database products meet the rigorous security standards required by our customers in the most highly regulated industries worldwide.

We act as the primary interface between external auditors and our internal Product, Engineering, and Legal teams. Our goal is to translate complex regulatory requirements into scalable operational processes, maintaining a compliant and audit-ready posture across our diverse portfolio.

The Program Manager / Senior Analyst is a mid-to-senior level individual contributor role responsible for leading high-stakes audits and specialized compliance workstreams. Unlike the Analyst level, this role takes full ownership of complex international frameworks—such as IRAP and ENS High—and manages the relationship with our Financial Services customers during audit deep-dives. You will lead internal audit cadences and perform gap analyses for new market expansions.

Responsibilities:

• Lead the end-to-end execution of specialized external audits (e.g., ENS High, IRAP, ISO 22301) and coordinate all phases from initial scoping to final certification
• Serve as the lead point of contact for Financial Services customer audits, facilitating meetings, responding to security questionnaires, and defending our control environment to external stakeholders
• Lead internal audit cadences and drive the POA&M tracking process, ensuring technical teams remediate findings within required SLAs
• Map new regulatory requirements to our central control framework, performing gap analyses to identify where existing controls can be leveraged for new certifications
• Conduct NIST CSF or similar maturity assessments to monitor the effectiveness of the Compliance Program and report findings to team leads
• Author and review customer-facing security documentation, ensuring it accurately reflects our technical controls and architectural guardrails
• Partner with Engineering and Product leads to implement compliance-by-design, ensuring future product roadmaps align with global regulatory shifts

Requirements:

• 7+ years in GRC, Information Security, or IT Audit, specifically within a high-growth SaaS/Cloud environment
• Deep understanding of cloud security principles (AWS/GCP/Azure) and a proven track record leading technical audits for ISO 27001, SOC 2, or ENS High
• Solid grasp of audit processes, terminology, and risk assessment standards. Certifications such as CISA, CRISC, CISSP, or ISO Lead Implementer are highly preferred
• Exceptional ability to lead meetings with external customers and auditors, translating technical complexities into business risk and compliance assurance
• Advanced proficiency in Jira for tracking control performance data and managing high-volume remediation workflows
• Practical experience performing gap analyses and maturity assessments at an enterprise level

Responsibilities & Expectations

• You are expected to be a subject matter expert who can operate with minimal supervision
• You don't just track tasks; you own the success of the program
• You are expected to navigate complex audit negotiations with external parties and drive internal technical teams toward compliance milestones without disrupting innovation

Scope & Complexity

• The scope is international and technically diverse. You will manage overlapping audit cycles across different global jurisdictions (e.g., Spain, Australia, US) and complex industry sectors
• You are responsible for identifying how a single technical control can satisfy multiple global regulatory requirements simultaneously

Authority & Impact

• You have the authority to lead audit engagements and represent MongoDB’s security posture to sophisticated Financial Services customers
• Your impact is direct: by securing and maintaining these certifications, you enable our sales organization to close enterprise-level deals in highly regulated markets

Expertise

• You will be recognized as an expert in implementing our Common Controls Framework
• You move beyond general compliance to become a specialist in how MongoDB’s architecture satisfies specific, high-bar standards like IRAP and ENS High. You are the go-to for mapping technical evidence to regulatory intent

Leadership

• Leadership in this role is demonstrated through influence and mentorship. While you may not have direct reports, you lead cross-functional project teams through intense audit cycles and mentor junior analysts on audit methodology, documentation standards, and professional communication

About MongoDB

MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the database for the AI era, enabling innovators to create, transform, and disrupt industries with software. MongoDB’s unified database platform, the most widely available, globally distributed database on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud database and is available across AWS, Google Cloud, and Microsoft Azure.

With offices worldwide and over 60,000 customers, including 75% of the Fortune 100 and AI-native startups, relying on MongoDB for their most important applications, we’re powering the next era of software.

Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It’s what makes us MongoDB. 

To drive the personal growth and business impact of our employees, we’re committed to developing a supportive and enriching culture for everyone. From employee affinity groups, to fertility assistance and a generous parental leave policy, we value our employees’ wellbeing and want to support them along every step of their professional and personal journeys. Learn more about what it’s like to work at MongoDB, and help us make an impact on the world!

MongoDB is committed to providing any necessary accommodations for individuals with disabilities within our application and interview process. To request an accommodation due to a disability, please inform your recruiter.

MongoDB, Inc. provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type and makes all hiring decisions without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

REQ ID: 1273402295

The Information Security Risk Team at MongoDB is the operational engine of the internal and third-party risk programs. Situated within the Assurance, Risk, and Compliance (ARC) organization, the team is responsible for the "Reduction of Uncertainty" across the enterprise. We view this team as the "Operational Commander" of the risk function. The team oversees the entire lifecycle of risk identification, assessment, and treatment, ensuring that MongoDB’s leadership has a clear, quantified view of the top risks facing the organization. We are not just a compliance function; we are a "Risk Intelligence" unit that empowers the business to "Think Big" while keeping our eyes wide open to the risks we accept.

As the Senior Information Risk Analyst, you will serve as the subject matter expert and primary executor of our risk function. Reporting directly to the Risk Director, you will be responsible for conducting and owning the lifecycle of internal security assessments (annual + ad-hoc), applying risk methodology, producing risk memos and working with asset/risk owners across the business that powers MongoDB’s growth. This is a pivotal moment for our Risk function as we scale operations to meet the demands of a $100B+ database market while navigating an increasingly rigorous regulatory landscape (DORA, FedRAMP, NIS2).

This role can be based remotely in the United States.

Responsibilities

Program Maturity

• Risk Assessment Methodology Implementation: Lead the strategic roadmap to integrate the risk matrix into the risk framework
• Regulatory Governance: Ensure the risk program complies with global regulations, specifically DORA (EU) regarding ICT registers and FedRAMP Rev 5 supply chain controls. Maintain the Supply Chain Risk Management (SCRM) plan and oversee strict boundary protections for the "Atlas for Government" environment
• Policy & Procedure Ownership: Maintain the Information Risk Management Procedure (ISQMS), ensuring that risk identification, assessment, and treatment processes are documented, updated annually, and followed consistently across the organization

Operational Execution

• Experience conducting technical security risk assessments (infrastructure, cloud, application-level). Including experience in evaluating control effectiveness through technical evidence (configurations, logs, architecture diagrams)
• Workflow Orchestration: Own the end-to-end risk assessment process
• Inherent Risk Scoring: Validate the team’s application of the Risk Scoring formula.   Apply the risk scoring formula for baseline scores based on breach history (last 12 months) and weighted impact
• Ensure the risk acceptance process has the right level of information and the appropriate stakeholders
• Ticket Hygiene: Actively manage the Jira backlog to prevent "frozen tickets”

Monitoring and Reporting

• Conduct annual enterprise security risk assessments and ad-hoc assessments as triggered by material changes, incidents, or new initiatives
• Identify risk scenarios for the in-scope assets by working with the asset and risk owners
• Assess the inherent risk and residual risk based on established risk assessment methodology and control assessments
• Synthesize the analysis into high-quality, Risk Assessment Memos. These documents must tell a cohesive story, moving from the "Risk Statement" to the "Calculation Logic" to the final "Risk Rating"
• Manage the risk acceptance process in JIRA, review for appropriateness and accuracy
• Maintain the Risk Management Dashboard and report on accurate risk metrics

Requirements

• Professional Experience: 10+ years of experience in Information Security, Governance, Risk & Compliance (GRC)
• Hands-on experience conducting enterprise-level security risk assessments end-to-end, including scoping, threat modeling, control evaluation, and executive reporting
• Evaluate control effectiveness using technical evidence (configs, logs, architecture diagrams)
• Perform threat modeling using established methodologies (STRIDE, MITRE ATT&CK)
• Deep operational understanding of risk assessment methodologies (NIST SP 800-30) and standard control frameworks (NIST CSF, NIST SP 800-53, ISO 27001, SOC 2, SIG Core/Lite, CAIQ)
• Regulatory Knowledge: Comprehensive knowledge of DORA, NIS2, FedRAMP Rev 5 (specifically Supply Chain/SCRM), GDPR, and PCI-DSS requirements
• Ability to write executive-level risk reports that translate technical flaws into business risks
• A strong track record of collaborating effectively across teams and levels to influence change
• Education: Bachelor’s degree in a relevant field (Cybersecurity, Business, Information Systems)
• Certifications: CRISC, CCSP, CISSP, CISA, relevant cloud certifications

About MongoDB

MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the database for the AI era, enabling innovators to create, transform, and disrupt industries with software. MongoDB’s unified database platform, the most widely available, globally distributed database on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud database and is available across AWS, Google Cloud, and Microsoft Azure.

With offices worldwide and over 60,000 customers, including 75% of the Fortune 100 and AI-native startups, relying on MongoDB for their most important applications, we’re powering the next era of software.

Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It’s what makes us MongoDB. 

To drive the personal growth and business impact of our employees, we’re committed to developing a supportive and enriching culture for everyone. From employee affinity groups, to fertility assistance and a generous parental leave policy, we value our employees’ wellbeing and want to support them along every step of their professional and personal journeys. Learn more about what it’s like to work at MongoDB, and help us make an impact on the world!

MongoDB is committed to providing any necessary accommodations for individuals with disabilities within our application and interview process. To request an accommodation due to a disability, please inform your recruiter.

MongoDB, Inc. provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type and makes all hiring decisions without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

Req ID: 1273387742

The Manager, GRC – SOX Digital Transformation plays a key role in executing and evolving the organization’s IT SOX compliance and controls modernization initiatives. This role focuses on enhancing the efficiency, automation, and effectiveness of IT general controls (ITGCs) and application controls through digital transformation efforts, including GRC tooling, data analytics, and process standardization. 

This individual partners closely with Internal Audit, Finance, and Technology teams to support SOX compliance, drive control improvements, and implement scalable, technology-enabled solutions that strengthen the overall control environment. 

Key Responsibilities 

SOX & IT Controls Execution 

• Support the end-to-end execution of IT SOX compliance activities, including scoping, walkthroughs, control testing, and remediation tracking. 

• Evaluate the design and operating effectiveness of IT general controls (logical access, change management, operations, and SDLC). 

• Coordinate with control owners to ensure timely completion of control activities and remediation efforts. 

• Assist in preparing audit-ready documentation and support external audit requests. 

SOX Digital Transformation & Automation 

• Drive initiatives to modernize and automate SOX IT controls through GRC platforms and enabling technologies. 

• Partner with stakeholders to standardize and optimize control design across systems and platforms. 

• Leverage data analytics and visualization tools (e.g., Power BI) to enhance control monitoring and reporting. 

• Support implementation, enhancement, and ongoing management of GRC tools (e.g., ServiceNow GRC, Archer, AuditBoard). 

• Identify opportunities to reduce manual effort, improve control reliability, and enhance audit efficiency. 

GRC Program Support 

• Contribute to the development and continuous improvement of IT GRC policies, standards, and procedures. 

• Participate in technology risk assessments across cloud, ERP, and SaaS environments. 

• Align IT controls with internal policies and external frameworks (e.g., COSO, COBIT, NIST). 

• Support compliance efforts related to SOC audits and other regulatory or certification requirements, as needed. 

Stakeholder Collaboration & Reporting 

• Partner with Internal Audit, Finance (SOX), and IT teams to ensure alignment on control requirements and testing approaches. 

• Translate control requirements into practical guidance for technical and non-technical stakeholders. 

• Track and report on SOX control performance, deficiencies, and remediation status. 

• Promote a culture of accountability and continuous improvement in controls and compliance. 

Qualifications 

Education 

• Bachelor’s degree in Information Systems, Computer Science, Accounting, Business, or a related field required. 

• Master’s degree (MBA, MIS, or equivalent) preferred but not required. 

Experience 

• 5–8+ years of experience in IT audit, IT risk, SOX compliance, or GRC. 

• Hands-on experience supporting SOX ITGC programs in a public company environment. 

• Experience working with or implementing GRC tools and audit management platforms. 

• Exposure to digital transformation, automation, or process improvement initiatives within GRC or audit. 

• Experience in Big 4 or public accounting environments preferred but not required. 

Certifications 

• CISA (Certified Information Systems Auditor) — Preferred 

• CISSP, CISM, CRISC, or CIA — Nice to have 

Technical Skills 

• Strong understanding of ITGC domains: access management, change management, operations, and SDLC. 

• Working knowledge of SOX 302/404 requirements and IT audit methodologies. 

• Familiarity with frameworks such as COSO, COBIT, and NIST CSF. 

• Experience with data analytics and reporting tools (e.g., Power BI, ACL, IDEA). 

• Exposure to cloud environments (AWS, Azure), ERP systems (SAP, Oracle), and SaaS platforms. 

Leadership & Soft Skills 

• Strong communication skills with the ability to work effectively across technical and business teams. 

• Detail-oriented with strong organizational and project management capabilities. 

• Ability to manage multiple priorities and meet deadlines in a fast-paced environment. 

• Collaborative mindset with a proactive approach to problem-solving. 

• Continuous improvement mindset with interest in leveraging technology to enhance controls. 

Core Competencies 

SOX & IT Controls Execution | Process Improvement & Automation 
Risk Awareness | Cross-Functional Collaboration 
Data-Driven Insights | Continuous Improvement 

Work Environment & Physical Requirements 

This role operates in a professional office environment with hybrid flexibility. The position requires extended periods of computer use. Occasional travel may be required (up to 15%). 

Job Title: Director, SOX & IT Compliance 

Position Summary 

We are seeking a strategic and results-driven leader to oversee and evolve SharkNinja’s SOX and enterprise IT compliance programs. This role will be responsible for ensuring the effectiveness, scalability, and continuous improvement of IT General Controls (ITGCs), automated controls, and broader compliance frameworks across the organization.  This person should have strong Oracle and Salesforce experience.  

The ideal candidate brings deep expertise in SOX compliance within a complex, fast-paced global environment, along with a strong understanding of enterprise IT systems, business processes, and risk management. This individual will partner cross-functionally to strengthen control environments, support audit readiness, and enable the business to scale with confidence while maintaining compliance with regulatory and internal standards. 

Key Responsibilities 

SOX Program Leadership & Governance 

• Lead the end-to-end SOX IT compliance program, including design, implementation, and ongoing evaluation of IT General Controls (ITGCs) and automated controls. 

• Ensure compliance with SOX requirements across key systems (ERP, financial applications, data platforms, etc.). 

• Own and continuously improve SOX governance, including control frameworks, documentation standards, and testing methodologies. 

• Partner with Internal Audit and external auditors to support annual audits, walkthroughs, and remediation efforts. 

• Drive consistency and standardization of controls across global systems and processes. 

IT Compliance & Controls Strategy 

• Develop and execute a forward-looking IT compliance strategy aligned with business growth and system evolution. 

• Oversee compliance across enterprise IT domains including access management, change management, system operations, and data integrity. 

• Identify control gaps and lead remediation initiatives to strengthen the overall control environment. 

• Ensure alignment with broader regulatory requirements (e.g., SOX, GDPR, and other applicable frameworks). 

Audit & Risk Management 

• Act as the primary liaison for IT compliance with Internal Audit, external auditors, and key stakeholders. 

• Lead risk assessments to identify areas of exposure within IT systems and business processes. 

• Establish and monitor key metrics to measure control effectiveness and audit readiness. 

• Proactively manage audit findings, ensuring timely and sustainable remediation. 

Systems & Business Process Alignment 

• Partner with IT, Finance, and business teams to ensure controls are embedded within system implementations, upgrades, and process changes. 

• Provide compliance oversight for major system transformations (e.g., ERP implementations, automation initiatives). 

• Promote the use of automation and scalable solutions to enhance control efficiency and effectiveness. 

Cross-Functional Leadership & Influence 

• Collaborate with IT, Finance, Legal, and business stakeholders to drive a culture of accountability and compliance. 

• Translate complex compliance requirements into clear, actionable guidance for technical and non-technical audiences. 

• Serve as a trusted advisor to senior leadership on SOX compliance, IT risk, and control strategy. 

• Build and lead a high-performing team focused on operational excellence and continuous improvement. 

Qualifications 

Required 

• 10+ years of experience in SOX compliance, IT audit, or IT risk management, with increasing leadership responsibility. 

• Deep expertise in IT General Controls (ITGCs), including access controls, change management, and IT operations. 

• Experience supporting SOX compliance in complex, multi-system environments (e.g., ERP platforms like SAP, Oracle, NetSuite). 

• Proven track record managing internal and external audits and driving successful remediation efforts. 

• Strong understanding of business processes impacting financial reporting. 

• Demonstrated ability to lead cross-functional initiatives and influence stakeholders at all levels. 

• Excellent communication skills with the ability to translate technical concepts into business terms. 

Preferred 

• Experience in a global consumer products or manufacturing environment. 

• Familiarity with additional regulatory frameworks (e.g., GDPR, CCPA). 

• Experience with control automation, GRC tools, or continuous monitoring solutions. 

• CPA, CISA, or similar professional certification. 

• Experience supporting large-scale system implementations or transformations. 

Core Competencies 

• Strategic leader with a strong risk and controls mindset 

• Expert in building scalable, sustainable compliance programs 

• Strong cross-functional collaborator and influencer 

• Operationally focused with a continuous improvement orientation 

• Pragmatic problem solver who balances compliance with business agility 

Impact of the Role 

This role is critical to ensuring SharkNinja’s continued growth is supported by a strong and scalable compliance foundation. By strengthening SOX and IT control environments, this leader will enable the organization to operate with integrity, mitigate risk, and maintain the confidence of auditors, regulators, and stakeholders. 

Role overview

The Principal IT Systems Administrator is the most senior individual contributor on the IT Systems team, setting technical direction for core platforms, endpoints, networks, and security within IT Operations. This role drives reliability, scalability, and automation.

You will lead complex initiatives, serve as a top escalation point, and partner across the business to ensure infrastructure and endpoints enable productivity while meeting security and compliance needs.

What you'll do

• System Configuration & Administration: Design and implement complex configurations for core IT platforms (identity, collaboration, infrastructure, SaaS). Establish configuration management, lead performance/reliability improvements, and automate repetitive tasks.
• Workspace & Endpoint Management: Design enterprise-wide endpoint strategies (macOS, Windows, mobile). Develop and enforce security policies, automate software/OS deployments via MDM/EMM, and own compliance reporting.
• Network & Infrastructure: Design and implement complex network configurations (LAN/WAN/Wi-Fi/VPN/voice) for scalability and security. Maintain monitoring, automate network management, and lead infrastructure projects (e.g., migrations, new site buildouts).
• Security Engineering & Operations: Define and drive security strategies within IT Systems (identity, access, endpoints, networks). Integrate security tools (SSO/MFA, EDR, DLP), enforce access policies, and act as a technical lead during critical security incidents.
• Incident Management & Reliability: Define and implement incident response strategies, lead Post-Incident Reviews (PIRs) to drive corrective action, develop runbooks, and oversee on-call rotations.
• Documentation & Knowledge Management: Define documentation standards (architecture, SOPs, runbooks) and ensure knowledge bases are accurate, comprehensive, and easily discoverable.

What you'll bring

• Extensive experience (typically 8+ years) in IT systems engineering/administration, with significant time in senior/lead roles on enterprise-scale environments.
• Deep expertise in: Core IT systems (identity, collaboration, directory), Endpoint management (MDM/EMM, lifecycle), Network infrastructure (switching, routing, VPN), and Security controls (EDR, SSO/MFA).
• Demonstrated ability to design complex configurations, lead large cross-functional projects, and influence architectural decisions.
• Strong automation mindset and proficiency with scripting/infrastructure-as-code (Python, PowerShell, Terraform).
• Proven track record leading major incidents and PIRs.
• Excellent cross-functional collaboration and communication skills, comfortable engaging all levels.
• Experience in environments with security, regulatory, or audit requirements (SOC 2, SOX).
• A bias toward ownership, documentation, and mentorship.

Nice to have: Experience in a high-growth SaaS or technology company, familiarity with CarGurus tools (Okta, Google Workspace/M365, Jamf, Intune), and experience partnering with Security Engineering and GRC.

Help us navigate the landscape of security and compliance, ensuring our platform remains a trusted solution for the world's leading companies. The Manager, Field Security role is critical to Smartsheet’s success, ensuring that internal controls and product features are communicated properly to customers and internal business operations. This role will report to the Sr Director, GRC Engineering  and work in our Bellevue, WA office, or remotely from anywhere in the US where Smartsheet is a registered employer.

Key Responsibilities

• Deal Acceleration - Capture new business by responding to customer security questionnaires and general security questions, ensuring impediments to closing deals are removed efficiently.
• Security Advisory - Retain and grow customers through direct engagement (high value and at-risk) and by providing security guidance for internal business operations.
• Security Evangelism - Enhance customer security and trust by providing industry-wide security expertise through podcasts, panels, and thought leadership.
• Leadership - Lead, manage, and grow a unified Field Security team, fostering a culture of customer security advocacy
• Operational Excellence - Continuously implement operational improvements and drive the delivery of accelerated processes to handle higher volumes and to increase velocity.
• Metrics & Reporting - Develop and maintain metrics and reporting to provide transparency into processes and highlight team performance against Service Level Agreements (SLAs).

Qualifications

• 10+ years of experience in Security Solutions, Sales Engineering, Security Architecture, or related fields.
• 5+ years of experience building and leading high-performing teams.
• Strong ability to partner with Sales, Marketing, Engineering, and Product teams.
• Knowledge of NIST 800-53, ISO, SOC 2, and FedRAMP Moderate/IL4.
• Professional certifications such as CISA, CRISC, or CISSP are preferred.
• Excellent written and verbal communication skills, with experience in public speaking or creating external-facing content.
• A collaborative approach with the ability to work independently and influence stakeholders at all levels to drive remediation and consensus.
• Legally eligible to work in the U.S. on an ongoing basis
• BS or MS in Computer Science, a related field, or equivalent industry experience

As a Senior Security Software Engineer for Infrastructure Security you will be a part of the Information Security organization and report to the Senior Manager of Infrastructure Security. You will help shape the future of Platform Security at Roblox. We work closely with Production IAM, Network Security, and Cloud Security at Roblox. 

You Will: 

• Identify security gaps and threats in our cloud and on premise infrastructure, partnering with Governance Risk and Compliance teams to create standards and policies along the way. This will help Roblox meet regulatory and compliance requirements.
• Harden our infrastructure by introducing secure by default configurations, designs and guardrails for all developers at Roblox.
• Own and drive solutions that enable Roblox engineers to design, build, and use infrastructure securely at scale.
• Work closely with other InfoSec teams (AppSec, D&R, GRC, CorpSec, CloudSec, NetSec) and partner with engineering teams across Roblox, specifically the Infrastructure organization, to ensure the secure outcomes of security and product driven initiatives. 

You Have:

• 5+ years of experience writing code and/or relevant technical experience.
• Experience with automation, IaC, system hardening, container security concepts, cloud security policy and observability.
• Deep knowledge of Linux systems, Kubernetes (EKS/GKE/AKS/RKS), and on premise and cloud based risk and supporting security infrastructure.
• Familiarity with Public Key Infrastructure (PKI), Data Encryption (at-rest and in-transit), platform security best practices, Secrets Management, and orchestration at scale with systems such as Chef, Nomad, and ECS.
• Understanding of network security, application security concepts, and information security industry best practices.

You Are:

• Collaborative: You love working with your direct team and cross-functional partners.
• Thoughtful of build vs. buy decisions: You can build solutions, but you also review what tools are available and are comfortable working with Third Party vendors.
• Comfortable with ambiguity: You can gather data and make informed decisions when there is no clear answer.

The Work

Ripple Treasury is a high-growth, $100M ARR SaaS business delivering mission-critical solutions for the Office of the CFO. Our adaptable, native digital platform serves the world’s most demanding finance organisations — enabling CFOs, Controllers, and Treasury teams to operate with greater speed, accuracy, and confidence; the “Clarity to Act”.

Our customers are large and enterprise-scale organisations, and we serve them through a fundamentally high-touch, relationship-driven model. We operate globally with significant presence across North America (US & Canada), Europe (London, Dublin, and Geneva), and Asia-Pacific (Singapore and Sydney). We are on a clear trajectory toward category leadership and are investing decisively in our customer experience and go-to-market capabilities to get there.

As Head of Customer Success, you will own the full post-implementation customer experience — from go live through to deep adoption and long-term advocacy — for a global, enterprise customer base where relationships are complex, stakes are high, and expectations are demanding. This is a seat on the Leadership Team and a pivotal role in driving how we retain, grow, and scale with our customers.

Your primary commercial mandate is the protection and growth of recurring revenue through disciplined retention management, pricing stewardship, and a deep commitment to driving product adoption. Where customers are getting maximum value from the platform, expansion naturally follows — and you will build the adoption engine that makes this a repeatable, measurable reality.

You will lead Customer Success, Support, and Customer Education, building the systems, talent, and AI-powered tooling required to deliver measurable, repeatable value at scale. You will be the voice of the customer in the leadership team, a trusted commercial partner to Sales, and the leader who sets the standard for what great customer experience looks like in enterprise FinTech.

Central to this role is the ownership of Ripple Treasury’s Customer Reference Programme. In enterprise software sales, references are not a courtesy — they are a commercial weapon. A well-prepared, enthusiastic reference from a peer CFO can accelerate a deal and eliminate competitive risk; a poor or unprepared one can destroy months of sales effort. Building a deep, diverse, and actively managed panel of reference customers is therefore a strategic priority for the business, and this role owns it end to end. The programme begins at implementation — identifying and nurturing potential advocates from the moment a customer goes live — and evolves throughout the customer lifetime into formal references, case studies, executive peer relationships, and public advocacy. Done well, the reference programme becomes one of Ripple Treasury’s most powerful go-to-market assets.

What you’ll do

Revenue Retention & Pricing Stewardship

• Own gross revenue retention (GRR) as the primary commercial accountability of the role — building the operational rigour, early-warning systems, and executive relationship depth to protect and grow the recurring revenue base.
• Lead the annual and in-cycle renewal process for enterprise accounts, ensuring renewals are managed proactively, professionally, and with a clear commercial strategy that reflects the value delivered.
• Act as a key voice in pricing decisions — partnering with Finance, Product, and Sales leadership to ensure price positioning is grounded in demonstrated customer value, market context, and long-term retention dynamics.
• Develop and manage a tiered account coverage model that matches resource intensity to account risk, strategic importance, and growth potential across the global portfolio.
• Maintain a real-time view of customer health, renewal risk, and commercial exposure across all regions, and report this clearly and confidently to the leadership.

Product Adoption & Customer Value Realisation

• Define and own the adoption framework for the business — including feature activation milestones, user engagement benchmarks, and outcome-based success metrics aligned to CFO priorities.
• Build structured Customer Success programmes — health check cadences, QBRs, and executive business reviews — that create a continuous conversation around value delivery and adoption progress.
• Partner with Product to ensure the platform is intuitive, well-documented, and supported by in-app guidance, self-serve resources, and AI-assisted help that reduces friction and accelerates time-to-value.
• Develop a Customer Education capability — including digital learning pathways, and power-user programmes — that embeds deep product knowledge within customer organisations.
• Use adoption data to generate account-level intelligence that Sales can act on: identifying expansion-ready customers, surfacing whitespace opportunities, and flagging where new use cases are gaining traction.
• Work closely with Sales and Marketing on the customer-led growth motion — ensuring CS insight feeds pipeline generation, case studies, and customer referral programmes.

Customer Support & Service Excellence

• Oversee the global Customer Support organisation, ensuring consistent, high-quality service delivery across all geographies and time zones (US, Canada, UK, Ireland, Switzerland, Singapore, and Australia).
• Set and hold the team accountable to SLA commitments and customer satisfaction benchmarks — including CSAT, NPS, and time-to-resolution — that reflect the high standards our enterprise customers expect.
• Drive a shift toward intelligent, AI-augmented support — deploying deflection tools, predictive issue detection, and AI-assisted case resolution that reduce effort for customers and free the team to focus on complex, high-value interactions.
• Ensure Support is positioned as a proactive function, not just a reactive one — flagging adoption gaps, product friction, and at-risk signals to CS and Product in real time.

AI-Powered Tooling & Operating Model

• Define and own the AI and technology roadmap for the Customer organisation — selecting, deploying, and continuously improving the tools that underpin CS, Support, and Education workflows.
• Champion the use of AI-driven customer health scoring that synthesises product usage data, support ticket patterns, engagement signals, and sentiment to provide a predictive, real-time view of each account.
• Deploy AI-assisted tooling for CSMs and Support teams — including intelligent playbook recommendations, automated at-risk alerts, AI-drafted customer communications, and summarisation of account history — to increase capacity and consistency.
• Use AI to scale the Quality Business Review process: automating data preparation, surfacing the most relevant insights per account, and enabling CSMs to spend more time on strategic conversation and less on slide preparation.
• Leverage AI-powered self-serve and in-product guidance to accelerate adoption journeys — reducing dependency on human-led intervention for common tasks and feature discovery.
• Build a culture of experimentation within the team — regularly testing new AI tools, measuring their impact on key metrics, and scaling what works across the global CS organisation.
• Partner with the Chief Technology Officer and Chief Product Officer to ensure the AI tooling strategy for the Customer team is aligned with the broader platform and data architecture.

Customer References & Advocacy

• Build and own a structured Customer Reference Programme that begins at implementation — identifying and nurturing potential reference customers from go-live, before they are ever needed by Sales, so that relationships are warm, stories are authentic, and references are given willingly rather than reluctantly.
• Partner with the implementation and onboarding teams to embed reference-readiness into the customer journey from day one — setting expectations with new customers early, capturing initial success stories at go-live, and progressively building the relationship depth required for credible, high-quality references as the account matures.
• Maintain a live, actively managed reference panel — segmented by industry, geography, use case, and customer size — that gives Sales the right reference for the right prospect at the right moment in every deal cycle. A generic reference is rarely as powerful as a matched one.
• Protect reference customers with the same rigour as pipeline — monitoring their health, acting quickly when sentiment shifts, managing reference fatigue by rotating requests thoughtfully, and ensuring that every reference commitment is properly briefed, prepared, and followed up with appropriate recognition.
• Work closely with Sales leadership to understand the deals where references are material to close — and escalate rapidly when a reference risk is identified. A single poor or unprepared reference in a competitive enterprise deal can be decisive; this function must be treated as a commercial priority, not an administrative one.
• Expand advocacy beyond individual reference calls — building a programme that includes executive peer networks, customer advisory boards, co-authored thought leadership, conference speaking opportunities, and case studies that give willing customers meaningful ways to advocate publicly for Ripple Treasury in the CFO community.
• Track reference programme health as a formal metric — including the size and quality of the active reference panel, reference request fulfilment rates, and the contribution of references and advocacy to Sales win rates — and report this to leadership alongside the core retention and adoption scorecard.

Voice of Customer & Cross-Functional Partnership

• Serve as the definitive internal champion for the customer, synthesising feedback, usage trends, and renewal signals into actionable insight for Product, Engineering, Marketing, and leadership.
• Establish robust VoC programmes — including NPS, QBRs, advisory councils, and win/loss analysis — that create a closed feedback loop from the frontline to the product roadmap and commercial strategy.
• Partner closely with the Head of Sales to align on the commercial handoff from post-sale to Sales, ensuring expansion opportunities identified through adoption data are translated into qualified pipeline.
• Represent the customer perspective in all leadership discussions.

Team Leadership & Organisational Development

• Build, lead, and inspire a globally distributed customer-facing organisation across Customer Success and Support, with a culture that is accountable, data-driven, and genuinely customer-obsessed.
• Develop a high-performance environment with clear career paths, coaching frameworks, and recognition programmes that attract and retain top talent across the US, Canada, UK, Ireland, Switzerland, Singapore, and Australia.
• Drive AI literacy and adoption within the team — ensuring every CSM and Support professional is equipped and expected to use AI tools as a core part of their daily workflow, not an optional add-on.
• Build the operational infrastructure — playbooks, KPI frameworks, health scoring, CS platforms, and reporting cadences — that makes the team scalable without losing the quality and personalisation that enterprise customers expect.

What you’ll bring

Essential Experience

• 10+ years of progressive experience in customer-facing leadership roles within B2B enterprise SaaS, with at least 3–5 years at the top table with clear ownership of post-sale revenue and retention.
• Demonstrated track record of achieving and defending strong GRR metrics at scale — ideally in a $50M–$200M ARR SaaS business — with experience navigating complex enterprise renewal negotiations.
• Proven experience building and scaling product adoption programmes that create a measurable link between feature engagement and commercial outcomes.
• Deep experience partnering with Sales on customer-led growth motions — turning CS insight into pipeline and customer advocacy into revenue.
• Hands-on experience deploying AI and automation tools within a CS or Support organisation — including customer health platforms, AI-assisted workflows, and self-serve/deflection tools.
• Experience serving customers in the Office of the CFO, financial technology, ERP, FP&A, treasury, or GRC verticals is highly desirable — the ability to converse credibly with CFOs and finance leaders is essential.
• Proven ability to manage high-touch relationships with enterprise or Fortune 500 customers, including executive sponsorship at C-Suite level across multiple geographies.
• Track record of building globally distributed teams that operate cohesively across time zones, cultures, and regulatory environments.

Leadership Attributes

• Customer obsessed — you hold a deeply held belief that customer outcomes and business outcomes are inseparable, and you bring this perspective to every internal decision.
• Commercially grounded — you understand that retention, pricing, and adoption are interconnected levers, and you manage them with precision and strategic intent.
• AI-forward — you are genuinely enthusiastic about the potential of AI to change how customer organisations operate, and you have the credibility and hands-on experience to lead this transformation.
• Data-driven — you operate from insight, not instinct alone; you are comfortable with health scoring models, cohort analysis, adoption funnels, and leading vs lagging indicators.
• Executive presence — you are credible, compelling, and confident in front of enterprise customer executives.
• Builder’s mindset — you are energised by the opportunity to create structure, process, and capability in a business that is still scaling, and you know the difference between building for now and building for scale.
• Collaborative and Sales-aligned — you see CS and Sales as one commercial team with different roles, and you invest in making the partnership between them a genuine competitive advantage.

Preferred Background

• Experience in financial technology, ERP, FP&A, treasury, or GRC SaaS solutions.
• Previous exposure to private equity or venture-backed high-growth environments.
• Familiarity with market leading CS and CRM platforms.
• Working knowledge of AI tools relevant to CS operations: LLM-based summarisation, predictive health scoring, AI-assisted communication, and in-product guidance platforms.
• Multilingual capability or deep experience leading teams across English, Spanish, French, and German-speaking markets.

Location Details: 

At GoDaddy the future of work looks different for each team. Some teams work in the office full-time, others have a hybrid arrangement (they work remotely some days and in the office some days) and some work entirely remotely.

This is a remote position, so you’ll be working remotely from your home. You may occasionally visit a GoDaddy office to meet with your team for events or meetings.  

This position is not eligible to be performed in Alaska, Mississippi, North Dakota, or the Virgin Islands.

GoDaddy is not currently considering candidates for this role in California, Seattle, or NYC.

Join our team

Do you want to be an Information Security Leader at GoDaddy? We help solve large-scale and cross-company issues while ensuring that partnership with the development and operational communities remain front of mind.

GoDaddy is looking for a Principal Risk Engineer with security risk management experience, technical depth, strong leadership abilities, and experience building and performing information security audits and gap assessments. You must be comfortable communicating with internal teams and external auditors, designing and leading security campaigns, and prioritizing the resolution of audit findings while applying a risk-based approach. As a team, we will help identify any gaps in security control implementation, design solutions to manage security risks at scale, and provide the information needed to make risk-based decisions and planning.

What you'll get to do...

• Build and manage a Security Controls framework that encompasses the regulatory and industry compliance frameworks we follow
• Perform targeted gap assessments to identify any deviations from the control framework
• Propose and manage enterprise-wide security campaigns for managing deviations to reduce risk
• Partner with other InfoSec teams and Engineering teams to define and prioritize security initiatives and investments guided by risk assessment principles
• Align risk management initiatives with applicable compliance regulations

Your experience should include...

• 10+ years of professional experience in Information Security or related fields such as Information Technology, IT Audit, etc.
• 6+ years of dynamic experience managing programs related to information security and information security audits
• Experience building unified security controls frameworks
• Experience managing audits applying compliance frameworks such as PCI DSS, NIST CSF, NIST 800-53, ISO, SOC-2 etc.
• Executive reporting on the status of security programs and campaigns
• Experience in Security Engineering concepts such as Threat modeling and architecture reviews
• Experience with auditing cloud infrastructure such as AWS

You might also have...

• A bachelor’s degree in computer science or related field
• Certifications like PCI ISA, CISA, CRISC, ISO Lead Assessor, CISSP, etc.
• Experience working at a Big 4 Audit firm(s)

We encourage you to apply even if your experience or skillset doesn’t align perfectly with every requirement. We value a wide range of backgrounds and transferable skills, and we are excited to support learning and growth.

About us...  GoDaddy is empowering everyday entrepreneurs around the world by providing the help and tools to succeed online, making opportunity more inclusive for all. GoDaddy is the place people come to name their idea, build a professional website, attract customers, sell their products and services, and manage their work. Our mission is to give our customers the tools, insights, and people to transform their ideas and personal initiative into success. To learn more about the company, visit About Us. 

At GoDaddy, we know diverse teams build better products—period. Our people and culture reflect and celebrate that sense of diversity and inclusion in ideas, experiences and perspectives. But we also know that’s not enough to build true equity and belonging in our communities. That’s why we prioritize integrating diversity, equity, inclusion and belonging principles into the core of how we work every day—focusing not only on our employee experience, but also our customer experience and operations. It’s the best way to serve our mission of empowering entrepreneurs everywhere, and making opportunity more inclusive for all. To read more about these commitments, as well as our representation and pay equity data, check out our Diversity and Pay Parity annual report which can be found on our Diversity Careers page.

We also embrace our diverse culture and offer a range of Employee Resource Groups (Culture). Have a side hustle? No problem. We love entrepreneurs! Most importantly, come as you are and make your own way. 

GoDaddy is proud to be an equal opportunity employer. GoDaddy will consider for employment qualified applicants with criminal histories in a manner consistent with local and federal requirements. Refer to our full EEO policy.

Our recruiting team is available to assist you in completing your application. If they could be helpful, please reach out to myrecruiter@godaddy.com. 

Colorado Residents: In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.

GoDaddy doesn’t accept unsolicited resumes from recruiters or employment agencies.

Job Summary of the Sr. Manager, Internal Audit

The Senior Manager, Internal Audit will establish and lead Axogen’s newly internalized Internal Audit function, overseeing all aspects of SOX compliance, internal controls, and operational audit activities. This individual will be responsible for designing, executing, and continuously improving the internal audit strategy while partnering cross‑functionally with Finance, IT, Operations, and other business units. The Senior Manager will serve as Axogen’s internal controls subject-matter expert, ensuring a strong control environment and alignment with regulatory expectations. The ideal candidate thrives in a fast-paced, collaborative environment and brings experience in a public company subject to SOX.

Requirements of the Sr. Manager, Internal Audit

• Bachelor’s degree in Accounting, Finance, or related field; CPA, CIA, or similar certification required (CIA preferred; CPA beneficial).
• Minimum 7 years of progressive internal audit, SOX, or public accounting experience, including experience in a public company environment or Big 4/public accounting.
• Minimum 5 years of leadership experience.
• Strong knowledge of SOX requirements, COSO internal control framework, and audit methodologies.
• Experience in MedTech, Pharma, Biotech, or other regulated industries preferred.
• Prior involvement in system implementations is a plus.
• Excellent analytical, organizational, and communication skills, with the ability to convey complex information clearly.
• Ability to manage multiple priorities and meet deadlines in a fast-paced environment.
• Strong problem-solving mindset with demonstrated ability to identify root causes and recommend scalable improvements.
• Advanced proficiency in Microsoft Office; strong Excel skills required.
• Experience with audit or GRC tools preferred.

Responsibilities of the Sr. Manager, Internal Audit

The specific duties of the Sr. Manager, Internal Audit include but are not limited to:

• Lead, mentor, and develop team members by fostering a culture of accountability, collaboration, and continuous growth; provide clear direction, set performance expectations, and support career development through coaching and feedback.
• Lead the development, execution, and ongoing enhancement of Axogen’s SOX program, including risk
• assessment, scoping, testing, documentation, and remediation tracking.
• Manage the transition of internal audit activities from a third‑party outsourced model to a fully in‑house function, establishing processes, frameworks, and best‑practice methodologies.
• Develop and maintain a formal risk assessment framework, ensuring consistent evaluation of likelihood, impact, and control effectiveness.
• Perform fraud risk assessments and identify areas requiring enhanced monitoring, testing, or preventive controls.
• Utilize analytics, data trends, and key risk indicators to augment risk assessment activities and improve audit planning.
• Partner closely with Finance, IT, and Operations in the design of processes, controls, process inefficiencies, and risks requiring mitigation or enhanced monitoring.
• Coordinate with external auditors regarding SOX reliance strategy, walkthroughs, testing schedules, and remediation plans.
• Perform end‑to‑end SOX control testing over the design and operational effectiveness of internal controls, including business process and automated controls impacting financial reporting.
• Oversee IT General Controls testing, including logical access, change management, segregation-of-duties compliance, and interface/job monitoring.
• Assess the design and operating effectiveness of key configuration and automated controls within key applications.
• Validate the completeness and accuracy of system-generated reports and data sets used in key financial and operational controls.
• Coordinate annual SOC 1 report reviews for third-party service providers, including evaluating complementary user entity controls and sub-service organizations.
• Track and validate remediation of control deficiencies and audit issues, partnering with business owners to implement sustainable solutions.
• Prepare clear, concise audit reports summarizing findings, root causes, and recommended corrective actions.
• Provide periodic reporting to senior leadership on audit results, trends, and opportunities for control enhancement.
• Prepare and deliver Internal Audit updates to the Audit Committee, including SOX status, key findings, remediation progress, risk assessment insights, and emerging risks.
• Evaluate third-party and outsourced service provider risks, including controls, data access, and continuity considerations.
• Collaborate with IT Security on cybersecurity-related risks that may impact financial reporting or operational audit scope.
• Support readiness efforts and future-state design relating to systems implementations, including ERP, HRIS and manufacturing systems, to ensure effective control design and documentation.
• Conduct operational, compliance, and process audits to assess risks, evaluate efficiency, and identify opportunities for improvement across the organization.
• Build strong, collaborative relationships across the business, promoting a culture of accountability and continuous improvement.
• Ensure compliance with company policies.
• Perform other related duties as assigned.

Location

111 West Oak Ave., Tampa, FL  33602

#LI-AC1

Benefits/Compensation

Roblox is looking for a Compliance Senior Manager who can lead the design, execution, and scaling of enterprise-grade regulatory risk assessment programs. This leader will be responsible for conducting and overseeing complex, regulatory-mandated risk assessments, particularly in highly regulated domains such as online safety. 

The ideal candidate brings deep experience performing regulatory-facing risk assessments at large technology platforms, along with strong program-building and stakeholder influencing capabilities. This individual will work closely with senior leadership and internal teams to cultivate a strong culture of compliance and risk awareness. This is a full-time, hybrid position reporting to the Head of Compliance.

You Will:

• Lead end-to-end execution of regulatory-required risk assessments
• Develop and maintain standardized risk assessment frameworks, methodologies, scoring models, and documentation standards aligned to global regulatory expectations
• Partner with Product, Engineering, Trust & Safety, Legal, Civility, Policy, Security, and Data teams to gather required inputs and validate risk findings
• Translate regulatory requirements into control expectations, mitigation roadmaps, and measurable risk-reduction actions, ensuring alignment with the centralized controls library
• Support enterprise governance forums by presenting key risk themes, emerging regulatory exposures, and mitigation progress
• Prepare regulator-ready documentation, evidence packages, and defensible narratives supporting company compliance positions
• Continuously refine risk assessment tooling, workflows, and automation to scale across multiple product surfaces and jurisdictions
• Build scalable processes that enable multiple concurrent regulatory assessments globally, coordinating execution timelines with the broader GRC program roadmap

You Have:

• 8+ years of experience in governance, risk, and compliance roles in a global technology company
• 3+ years working in a highly regulated domain such as integrity, online safety, privacy, or security
• Demonstrated experience conducting regulator-mandated risk assessments across several domains, including the UK Online Safety Act, Digital Services Act, and EU General Data PRotection Regulation 
• Strong understanding of global regulatory frameworks impacting digital platforms (e.g., online safety, privacy, platform integrity, AI governance, payments compliance)
• Proven ability to drive complex cross-functional initiatives involving product and engineering teams
• Experience building or scaling structured risk assessment methodologies, templates, and governance processes
• Bachelor's degree or higher in law, finance, or a related field or equivalent experience
• Strong interpersonal and analytical skills for communicating sophisticated concepts to both technical and non-technical audiences
• Experience designing and operationalizing scalable and efficient compliance workflows
• Ability to navigate ambiguity and lead multiple projects in a fast-paced, deadline-driven environment
• Excellent communication, leadership, and stakeholder management abilities
• Relevant certification (e.g., CRMP, CISA) is helpful

Roblox is looking for a Senior Compliance Program Manager to step into a critical role that will focus on building, managing, and scaling our transparency reporting program in partnership with legal, data science, engineering, and product teams.  You will also focus on managing the end to end process for responding to complex requests for dataset access.  

The ideal candidate is equally comfortable querying and working with raw data sets as they are with managing and executing compliance programs.  You thrive in a fast-paced environment where you are expected to effectively manage multiple highly-cross-functional programs at once. You have deep experience in transparency reporting and regulatory compliance data operations. 

You Will:

• Drive Complex Data Requests: Coordinate with Engineering, Legal, Data Science, and Product teams to process, organize, and extract time sensitive complex requests for dataset access, ensuring adherence to strict privacy and security standards.
• Manage Transparency Roadmaps: Partner closely with our Transparency Reporting Product Manager and Data Science teams to build, maintain, and execute comprehensive roadmaps for our public transparency reporting.
• Manage End-to-End Publication: Oversee the lifecycle of our transparency reports from data collection and validation to drafting, cross-functional review, and final public release.
• Mitigate Project Risks: Monitor work streams, identify technical or operational bottlenecks, and implement solutions to ensure regulatory deadlines and publication dates are met on time.
• Streamline Processes: Build, develop, and optimize programmatic documentation, workflows, and trackers for data requests and the transparency reporting program.

You Have:

• Experience: 6+ years of experience in Technical Program Management, Compliance, Transparency Reporting, or Data Science preferably within the Technology sectors.
• Technical Acumen: Demonstrated experience working directly with Data Science and Engineering teams. Familiarity with database architecture, data pipelines, and query languages (e.g., SQL) to effectively scope and organize data pulls.
• Reporting Experience: Prior experience supporting the creation, data validation, and publication of public-facing transparency reports, compliance audits, or complex external data disclosures.
• Regulatory Fluency: Demonstrated capability to become fluent in relevant regulatory frameworks, especially those focused on online safety. 
• Structured Organization: Exceptional project management skills with the ability to track hundreds of moving parts simultaneously using tools like Jira, Asana, Airtable or GRC platforms.
• Communication Skills: You are an excellent writer and verbal communicator who can synthesize complex technical and legal concepts for diverse audiences.
• Cross-Functional Influence: Ability to manage competing priorities across dependent teams, drive alignment, and deliver under tight deadlines.

We are looking for a Privacy & Security Counsel to join our Privacy & Security Legal team. This role is focused on legal security, and you will provide insights and guidance on a range of such issues from laws and regulations to incidents and policies.

Role is based in our San Mateo, CA office on a hybrid model (Tuesday-Thursday) #LI-Hybrid

You will:

• SME on Law: Provide subject-matter expertise and guidance on the evolving global security and privacy legal landscape, including legislation, regulations, enforcement actions, and best practices,  translating analysis into clear, concise, and actionable guidance to both legal and security teams.
• Incident Response Engagement: Engage with the Detection and Response and Global Security teams during incidents. Provide legal guidance throughout the incident, including during verification, triage, containment, remediation, post-mortem, table-top exercises, counseling internal stakeholders throughout the incident lifecycle, reporting to regulators, and notifying customers to meet our global obligations. 
• Security Compliance Support: Own and deliver complex, cross-functional cybersecurity legal initiatives end-to-end (e.g., new regulatory regimes, major incident response improvements), with clear milestones, stakeholder alignment, and measurable outcomes. Continuously improve incident response policies and playbooks that meet the standards of applicable global data privacy and security laws.
• Security Team Support: Embed within security pods as a trusted partner and go-to legal resource for regular expertise, insights, guidance, and support to different security teams, including Application Security, GRC, Privacy Engineering, Global Security, and Infrastructure/Platform teams, developing a working understanding of Roblox’s architecture, data flows, and operational constraints.
• Cross-Functional Legal Advice: Provide subject matter expertise in privacy and security and support to cross-functional legal advocacy teams, including corporate, employment, compliance, policy, regulatory, product, privacy, and commercial.

You have:

• 5+ years of data security, data privacy, data protection and governance experience.
• Expertise in US and global data security and protection laws and regulations.
• Knowledge of security regulations and frameworks, such as GDPR, NIS2, CCPA, COPPA, CA SB 553, NIST CSF, and PCI.
• Experience working with Information Security teams, including Incident Response, Application Security and Governance.
• Experience with security incidents including, breaches, breach reporting to regulators, customer notifications.
• Experience implementing global data protection and security requirements.
• Training at a major national law firm; in-house experience a plus.
• Active membership in at least one U.S. state bar; California Bar admission preferred.
• Excellent business-oriented judgment.
• Experience operating as a senior individual contributor in a fast-paced technology company, driving complex, cross-functional programs.
• Proven track record of taking ambiguous, cross-functional projects from concept to delivery, using strong project management skills to drive accountability and hit deadlines.
• Exceptional written and verbal communication skills, including the ability to “speak the language of the business” (not the law firm) and tailor messaging to executives, engineers, and operations teams.
• Working familiarity with large-scale, modern infrastructure (e.g., cloud platforms, microservices, observability, incident management tooling) sufficient to understand how technical architectures influence legal risk and incident response.

Roblox is looking for a Senior Program Manager to step into this critical role focusing on preparing for and managing rigorous internal and external regulatory compliance audit requirements . You will act as the central nervous system of our compliance audit defense, serving as the primary bridge between internal and external auditors, product and engineering subject matter experts (SMEs), and legal.

The ideal candidate is highly-organized, motivated, reliable and execution oriented.  You thrive in a fast-paced environment where you are expected to effectively manage multiple highly cross functional programs at once. 

You Will:

• Lead Compliance Audit Execution: Orchestrate the end-to-end lifecycle of internal and external audit requirements, ensuring strict adherence to timelines and scope.
• Act as the Primary Coordinator: Serve as the central coordinating function for audit activities. You will translate auditor requests into actionable tasks for Engineering, Product, and Safety teams, and conversely, translate internal information into audit evidence. 
• Manage Legal Sign-Off Workflows: Design and enforce a rigorous chain-of-custody process for all audit evidence. You will ensure that no document, data point, or response is submitted to external auditors without explicit review and approval from designated Legal SMEs.
• Drive Readiness & Mock Audits: Help Roblox improve its audit readiness through "mock audit" exercises to identify risks and ensure internal teams are prepared for rigorous audit requirements.
• Coordinate Evidence Gathering: Manage the collection, organization, and repository of thousands of evidence artifacts. You will challenge the quality of evidence provided by SMEs to ensure it fully answers the audit test steps before it reaches Legal review.
• Track Remediation: If audit findings requiring remediation arise, you will partner with cross-functional teams to track audit remediations through to completion.
• Develop Metrics: Identify and develop audit program metrics that will monitor program health, inform program goals, and be leveraged to monitor and report out on audit program status.
• Report to Leadership: Provide regular status updates, risk flags, and executive summaries to senior leadership regarding audit findings and the health of the audit program.

You Have:

• Experience: 7+ years of experience in Program Management, Compliance, Risk Management, or External Audit, preferably within the Technology sectors.
• Regulatory Fluency: Demonstrated capability to become fluent in relevant regulatory frameworks, especially those focused on online safety. 
• Audit Management Skills: Proven ability to manage complex third-party audits (e.g., SOC2, ISO, Regulatory Audits) from scoping to final report. You understand audit terminology (controls, sampling, evidence) and can explain it to non-compliance audiences.
• Legal Acumen: Experience working closely with Legal Counsel. You understand the concepts of privilege, risk exposure, and the importance of precise wording in regulatory submissions.
• Cross-Functional Leadership: The ability to influence stakeholders without direct authority. You can motivate Engineering and Product SMEs to prioritize compliance tasks alongside their roadmap work.
• Structured Organization: Exceptional project management skills with the ability to track hundreds of moving parts simultaneously using tools like Jira, Asana, Airtable or GRC platforms.
• Communication Skills: You are an excellent writer and verbal communicator who can synthesize complex technical and legal concepts for diverse audiences.

The Impact You’ll Be Contributing to Moloco: 

The Program Manager within the Enterprise Compliance Office (ECO) drives execution of Moloco’s global compliance priorities by translating strategy into structured, measurable, and repeatable delivery. You’ll lead high-impact, cross-functional programs, bring structure to ambiguity, and build scalable systems that enable the business to grow across multiple regions and regulatory environments. You’ll gain deep exposure to how a modern and global compliance organization operates while developing expertise at the intersection of compliance, operations, and data-driven execution.

This role will report to the Enterprise Compliance Officer & Associate General Counsel (Employment & Ethics) and will partner cross-functionally across Legal, Security/GRC, Product, Engineering, People, Finance, and Business teams to coordinate complex global compliance initiatives, manage dependencies, and ensure that our most important compliance commitments are delivered on time with high quality. In addition to core program management responsibilities, this role incorporates targeted analytical capabilities to strengthen evidence readiness, data quality, and operational rigor across compliance workflows.

This role is based near our Menlo Park, CA office and follows a hybrid in-office schedule.

The Opportunity: 

• Lead end-to-end program management for enterprise global compliance initiatives, coordinating across teams to deliver on commitments, risks, and milestones.
• Create and drive integrated program plans and workflows, including roadmaps, milestones, dependencies, resourcing, decision points, and standardized intake and routing processes. Track intake volume, cycle time, handoffs, and rework drivers.
• Apply creative, practical problem-solving to navigate ambiguity and develop scalable solutions across complex compliance challenges.
• Define and manage the program delivery approach, including plan structure, operating cadence, and change control.
• Drive cross-functional alignment across Legal, People, Security/GRC, Product, Engineering, and business teams.
• Sequence work and manage interdependencies across initiatives to ensure timely delivery of program milestones.
• Track overall program health, identify risks or delays, develop risk mitigation plans, and escalate issues as needed to keep work on track.
• Operate program governance, including decision logs, RAID tracking, status reporting, and escalation management through resolution.
• Ensure audit and regulatory readiness by tracking commitments and delivering high-quality, complete, and well-documented outputs suitable for governance and executive review.
• Establish and manage remediation pipelines, ensuring clear ownership, severity, timelines, and evidence of closure.
• Build and maintain program metrics and dashboards, including KPIs, OKRs, and KRIs, to improve visibility and predictability. Analyze compliance data, documentation, and workflows to identify gaps, inconsistencies, and opportunities for improvement.
• Strengthen evidence quality and documentation standards in partnership with control owners and stakeholders.
• Develop and scale repeatable program infrastructure, including playbooks, templates, workflows, and tooling, to improve operational maturity.

How Do I Know if the Role is Right For Me? 

• 8-10+ years of relevant compliance experience, including in-house experience, preferably in fast-paced, high-growth or startup environments.
• Strong program management foundation, with experience leading complex, cross-functional initiatives (PMO experience or certification preferred).
• Experience in compliance, legal, risk, privacy, security, audit, or regulated environments.
• Ability to translate ambiguity into structured plans, manage shifting priorities, and drive execution.
• Strong communication and drafting skills, with the ability to influence executive stakeholders and collaborate cross-functionally.
• Highly organized, proactive, and self-directed, with a hands-on, “roll up your sleeves” approach and ability to manage multiple priorities.
• Experience building or supporting:
  • Program governance frameworks (cadence, reporting, escalation)
  • Metrics, dashboards, and reporting structures
  • Audit readiness or evidence tracking processes
• Demonstrated ability to:
  • Analyze data, documentation, and workflows to identify gaps and improve processes
  • Maintain high-quality documentation and evidence standards
  • Partner with stakeholders to operationalize compliance requirements into scalable processes.
• Familiarity with tools such as Jira, Confluence, GRC platforms, and other program, project, or workflow management systems.
• Comfortable working in a fast-paced, global environment with multiple stakeholders and competing priorities.

ABOUT THE TEAM

The Corporate Assurance Team manages enterprise cybersecurity governance, risk, and compliance (GRC) by implementing and operationalizing global compliance frameworks across Anduril's corporate and product environments. The team serves as the bridge between regulatory requirements and engineering execution, ensuring that Anduril's rapidly evolving technology stack meets the highest standards of security and compliance.

ABOUT THE JOB

The Compliance Engineer is a technically hands-on role responsible for driving automation, compliance, and security engineering principles into the design, integration, and operation of Anduril's internal systems. This individual will be instrumental in securing Anduril's software development process by translating complex compliance requirements into scalable, automated, and developer-friendly solutions.

The ideal candidate brings a strong DevSecOps background with deep expertise in cloud infrastructure security, embedded systems security, and federal compliance frameworks. They are equally comfortable writing Terraform modules as they are interpreting NIST controls, and they thrive at the intersection of security policy and engineering execution.

This is not a paperwork-driven compliance role. This is a builder's role. You will architect and automate compliance infrastructure that enables Anduril's engineering teams to deploy secure, compliant applications by default — removing bottlenecks rather than creating them.

WHY THIS ROLE MATTERS

At Anduril, compliance is not a checkbox — it is an engineering discipline. The Compliance Engineer plays a critical role in ensuring that Anduril can move fast without compromising the security and regulatory posture required to serve national defense missions. By building compliance into the foundation of our infrastructure, you will directly enable engineering teams to focus on what they do best: building transformative technology that protects those who protect us.

KEY RESPONSIBILITIES

Infrastructure & Automation

• Design, develop, and maintain Infrastructure as Code (IaC) and Policy as Code (PaC) that enforce compliance with NIST SP 800-171 and 800-53, CMMC, and other applicable frameworks, enabling developers to deploy CMMC-certified applications using pre-packaged, compliant infrastructure templates.
• Architect, build, and deploy robust, scalable security controls across Anduril's corporate, development, and production cloud environments (AWS, Azure, GCP) and on-premise environments.
• Develop and automate IaC pipelines for managing and scaling cloud deployments securely and efficiently, including automated pipelines for deploying infrastructure, applications, and updates.
• Build automation for procedural compliance controls, generating compliance and audit artifacts at scale without manual intervention.
• Develop security models that integrate Continuous Monitoring (ConMon), DISA STIG scanning, and compliance reporting into a unified, automated workflow.
• Ensure that compliance requirements for rapid, secure deployments translate into robust, repeatable tool chains.

Compliance Engineering & Framework Implementation

• Analyze, interpret, and operationalize federal and industry cybersecurity regulations, including NIST SP 800-171 and 800-53, CMMC, FedRAMP, and SOC 2, translating regulatory language into actionable engineering guidance and enforceable technical controls.
• Evaluate system architectures and configurations to ensure alignment with required security controls for moderate-impact information systems.
• Interface directly with infrastructure teams to verify and enforce compliance across existing on-premise and cloud stacks, identifying gaps and driving remediation.
• Collect, review, and where necessary modify system architecture to meet evolving compliance requirements, ensuring that security is embedded into the design phase rather than bolted on after the fact.
• Conduct compliance testing, studies, and assessments of Anduril's products and integrated components to uncover potential weaknesses and validate control effectiveness.
• Develop, update, and maintain cybersecurity policies, standards, procedures, and playbooks in coordination with the Information Security Team.
• Stay current on changes to federal and industry cybersecurity regulations and proactively communicate their impact to engineering and leadership teams.

Cross-Functional Collaboration & Enablement

• Partner with engineers, the DevSecOps Team, and the Automation Team to implement and verify security controls in both corporate and product software environments.
• Act as a force multiplier by embedding security best practices into the workflows of infrastructure, application, and product teams, particularly for environments holding mission-critical data.
• Support and expedite the new software onboarding process by evaluating the technical requirements of new software for CMMC compliance and guiding developers through the path to compliant deployment.
• Coordinate and deliver briefings to ensure Anduril's technical teams understand their compliance obligations, translating complex security concepts for diverse technical and non-technical audiences.
• Brief security architectures and approaches to program leadership, providing clear recommendations and risk-informed guidance.
• Work closely with Information Systems leadership, project managers, and stakeholders to integrate compliance requirements into active projects and update or modify compliant systems as organizational needs evolve.
• Collaborate with other principals and subject matter experts to ensure end-to-end automation across the compliance lifecycle.
• Act as SME for security and automation topics during internal reviews, audits, and cross-team planning sessions.

Strategic & Advisory

• Develop strategies and implementation plans for compliance-related matters, advising management on risk posture, regulatory changes, and investment priorities.
• Institute best-practice procedures for compliance and risk mitigation across the organization.
• Guide technical and operational decision-making towards future product offerings and efficient organizational processes.
• Ensure the company's ongoing technical compliance with all applicable laws, regulations, and contractual obligations.
• Produce clear documentation and reporting on compliance testing outcomes, process improvements, and emerging risks.

REQUIRED QUALIFICATIONS

Education & Experience

• 3+ years of professional experience in Cloud Security, DevSecOps, Site Reliability Engineering (SRE), or a related security engineering role.
• Background in one or more of the following disciplines: Systems Security Engineering, Cybersecurity, Systems Engineering, Software Engineering, Computer Engineering, or Computer Science.
• Proven experience building and securing complex cloud environments at scale.
• 3+ years of hands-on experience working with compliance frameworks such as CMMC, NIST SP 800-171 and/or 800-53, and FedRAMP.
• Previous work on security engineering and architecture for defense/national security systems and/or complex embedded commercial systems is strongly preferred.
• Hands-on experience executing against recurring operational regulatory requirements (e.g., continuous monitoring, periodic assessments, audit cycles).

Technical Skills

• Deep proficiency in at least one major cloud provider (AWS, Azure, or GCP), with a strong understanding of cloud infrastructure and security concepts.
• Strong hands-on experience with Infrastructure as Code tools, particularly Terraform; experience with CloudFormation or Bicep is a plus.
• Demonstrated ability to build, deploy, and manage Terraform modules and infrastructure templates in production environments.
• Solid programming and scripting ability in one or more languages (e.g., Python, Go, Rust).
• Firm understanding of public cloud networking principles, including VPCs, subnets, routing, security groups, and network segmentation.
• Proficiency with core security concepts including encryption, authentication, identity and access management, and Zero-Trust Architecture (ZTA).
• Experience with continuous monitoring and security tooling such as Tenable, Splunk, Elasticsearch, or equivalent platforms.

Soft Skills & Competencies

• Ability to communicate compliance requirements clearly and effectively to engineering teams, development teams, and non-technical stakeholders.
• Strong understanding of the "why" behind product, systems, and security design decisions — not just the "what."
• Comfort working at the interface of compliance and infrastructure engineering, with the ability to context-switch between policy interpretation and hands-on technical work.
• Self-directed, with the ability to prioritize across multiple concurrent compliance and engineering initiatives.

Eligibility

• Must be eligible to obtain and maintain a U.S. Secret security clearance.

PREFERRED QUALIFICATIONS

• Experience hardening and monitoring Kubernetes clusters (EKS, GKE, AKS).
• Experience with Cloud Security Posture Management (CSPM) or cloud-native threat detection tooling.
• Familiarity with CI/CD pipelines and experience securing the software supply chain.
• Experience with security assessment methodologies and vulnerability management programs.
• Relevant certifications such as AWS Solutions Architect, Certified Kubernetes Administrator (CKA), CISSP, CISM, or CompTIA Security+.
• Experience working in fast-paced, high-growth defense technology environments

Senior Software Engineer: Front-End

About the role 

We are seeking someone to lead, architect and develop features for our Risk Cloud platform. This role requires a deep understanding of business and engineering goals, and the ability to work collaboratively with team members to achieve them. The ideal candidate will inspire and exemplify cross-functional collaboration, working closely with product managers, designers, engineers, and QA professionals. They will advocate for and implement modern best practices in engineering, including a testing-first mindset, frequent releases, and iterative development with small feedback loops. Additionally, effective communication and the ability to produce clear documentation for features and processes are essential for this position.

How you'll spend your time:

• Develop / Utilize Angular, Typescript, and other leading Front-End tools to build a market leading product.
• Quality / Write tests and review code to facilitate an efficient dev cycle and prevent the occurrence of bugs.
• Collaborate / Work closely with cross-functional team members using Agile methodologies to iterate on feature work.
• Optimize / Help improve our front-end application for speed, reliability, and scalability.

What we use:

• Frontend: TypeScript, Angular, Webpack, Sass
• Backend: Spring Boot, Java, Kotlin, Go
• Data: Neo4j, Redis, RabbitMQ, PostgreSQL
• Test: JUnit, Karma, Jasmine, Spectator, Cypress
• Infrastructure: AWS, Terraform, Kubernetes, Docker, Ansible
• Work: GitLab, Slack, Jira, Confluence, G Suite

We get excited about you if you have:

• Significant (6+ years) of professional experience in software engineering or a Bachelor's in Computer Science or a related field (we value outcomes over number of years)
• Desire to grow as a leader, architect, and coder within an engineering atmosphere that moves quickly and strives to raise the bar.
• Understanding of best practices and competency in one or more modern languages (it doesn't have to be a language that is part of our stack).
• Strong expertise developing web applications with modern Front-End frameworks.
• Desire for an autonomous environment that enables you to do your best work.

How you’ll Raise the Bar:

• The tools, languages, and frameworks powering our platform align with your work history.

• While a Front-End expert, you thrive working across the full software stack.
• You’ve worked to bolster or optimize E2E systems.

The anticipated base salary range for the role is $125,000 - $165,000 per year + variable + equity + benefits. Actual salaries may vary and will be based on factors, such as the candidate's qualifications, skills, competencies, and proficiency for the role. Internal candidates who have current pay within or above the hiring range are still encouraged to apply if interested.

LogicGate’s Hybrid Workplace

Our hybrid workplace allows for flexibility aligned to role responsibilities and exceptional customer delivery. Location requirements for this role can be found above. 

Total Rewards 

We are proud to offer a variety of competitive, inclusive, and comprehensive total rewards that are designed to support the unique needs of our employees both inside and outside of the workplace.

In addition to offering competitive salary and variable compensation plans, equity options, and flexible health and wellness benefits, we are proud to offer generous PTO, Annual Company Holidays, Health Days, and Summer Fridays.

Employees' growth and development are supported throughout their career journey through informal and formal programs and activities, including access to LinkedIn Learning, regular People Leader training, and our internal Mentorship Program. 

Our Culture

At LogicGate, our culture and employee experience are grounded in our core values of Be as One, Do the Right Thing, Embrace Curiosity, Own It, Empower Customers, and Raise the Bar, which guide how we show up - for each other, our customers, and all we interact with.

We believe that the strongest teams are made up of individuals who bring their different identities, experiences, and perspectives to the table. We are committed to fostering an inclusive work environment where all employees’ differences are celebrated and everyone is encouraged to bring their authentic selves to work.

We encourage everyone to join one of our Employee Resource Groups (AAPI @ LogicGate, Pride at LogicGate, and Women in LogicGate) to participate in and contribute to conversations that foster an inclusive culture.

LogicGate also believes strongly in giving back to the communities in which we live and work. To enable our teams to give back, we offer paid volunteer hours and company-wide charitable activities supporting a variety of organizations and causes.

We are proud to have been recognized as a top workplace by Built In, Crain’s Chicago Business, the Chicago Tribune, and more. Visit our website to learn about our latest recognition.

Learn more about our culture here. 

Excited about LogicGate but not familiar with GRC? 

• GRC stands for Governance, Risk, and Compliance
• GRC professionals help their companies manage uncertainty, act with integrity, and stay on the right side of the law. 
• The GRC market is rapidly expanding with continuous growth opportunities. The current market size was valued at $50.5 billion in 2024 and is projected to reach $104.5 billion by 2031.

What you'll do

As our first Product Security Engineer, you will sit at the intersection of Security and Software Engineering. You will be a "Security Builder": embedded within our engineering teams with the autonomy needed to build the automation, tools, and workflows that make security a seamless part of the software development lifecycle.

You aren't just finding bugs; you are building the systems that prevent and fix them at scale. Your work will be centered on three core strategic pillars:

• Secure architecture and auth: you will design and implement auth enhancements such as magic link improvements and access/audit log features to monitor access and improve transparency.
• Privacy engineering: you will lead the privacy engineering initiatives including DSAR integration, building automated data deletion capabilities directly into the Pomelo mobile app and our internal platform to ensure seamless compliance. You will also help improve privacy-preserving data de-identification and anonymization as needed.
• Full-cycle remediation: you will own the end-to-end pentest-to-fix lifecycle. This means you don't just triage reports; you write the code to fix penetration test findings, remediate SAST issues, and build greenkeeping systems for high-volume dependency patching with regression testing.

Beyond these pillars, you will serve as a high-leverage engineering partner to the broader InfoSec team by:

• Building secure-by-default libraries: reducing the load on core Software Engineering by creating internal libraries and patterns that make security the default path.
• Threat modeling: partnering with engineering leads to conduct threat modeling and ensure secure design at the earliest stages of the development process.
• Scaling through collaboration: as a security resource embedded in our engineering teams, you will help engineering squads navigate complex security use cases, translating GRC requirements into elegant code rather than manual checklists.

Who you are

You’re an enthusiastic and collaborative engineer who enjoys solving meaningful problems through code. You view security as a product challenge, and you believe the best way to secure a system is to make the "secure way" the "easy way." In particular, you:

• Are a builder first: Have 5+ years of software engineering experience with a strong foundation in computer science and a track record of shipping production-grade code (Python, Go, Kotlin or similar).
• Have a security mindset: You understand the OWASP Top 10, identity flows and prompt injections, but you’d rather build a system that eliminates a class of vulnerability than manually triage individual alerts. You believe security expertise should be embedded into the development process, not bolted on at the end.
• Are an automation enthusiast: you enjoy tackling complex problems with practical automation and are keeping up with trends in LLM agents to multiply your engineering impact.
• Navigate ambiguity: as a floating resource across various engineering teams, you are comfortable context-switching and can quickly build rapport with different engineering teams to understand their needs.
• Prior experience in healthcare data: including understanding of HIPAA, SOC 2 Type 2 and HITRUST compliance requirements.

We’ll be super excited if you

• Have experience with Google Cloud Platform (GCP), Github Advanced Security (GHAS), Stytch, Sentry, Fullstory, Statsig or similar technology stack.
• Have experience building data infrastructure that supports AI/ML workloads,internal developer platforms and privacy preserving data de-identification and anonymization techniques.
• Have previously worked in a fast-paced, product-oriented startup environment.

Why you should join our team

By joining Pomelo, you will get in on the ground floor of a fast-moving, well-funded, and mission-driven startup that always puts the patient first. You will learn, grow and be challenged -- and have fun with your team while doing it.

We strive to create an environment where employees from all backgrounds are respected. We also offer:

• Competitive healthcare benefits
• Generous equity compensation
• Unlimited vacation
• Membership in the First Round Network (a curated and confidential community with events, guides, thousands of Q&A questions, and opportunities for 1-1 mentorship)

At Pomelo, we are committed to hiring the best team to improve outcomes for all mothers and babies, regardless of their background. We need diverse perspectives to reflect the diversity of problems we face and the population we serve. We look to hire people from a variety of backgrounds, including but not limited to race, age, sexual orientation, gender identity and expression, national origin, religion, disability, and veteran status.

Hudson River Trading (HRT) is seeking a Security Governance, Risk, and Compliance Lead to join our growing Information Security team. This role will lead security governance programs for HRT entities based in America, Europe, and Asia, and will work directly on automating security governance at scale.

In this hands-on role, you will liaise closely with HRT’s Compliance and Legal teams to research, build, and maintain security solutions for a diverse set of industry regulations and requirements. You’ll lead a technical team responsible for owning and strategically ensuring HRT’s compliance with global security regulations, helping to equip HRT to enter new markets with increasingly complicated regulatory needs. 

Responsibilities

• Manage and lead a team of security GRC engineers
• Perform internal and external security control assessments using industry standard frameworks such as NIST and CIS
• Conduct threat modeling and risk assessments
• Create and maintain security and compliance policies, standards, and guidelines
• Track regulatory security compliance obligations worldwide
• Work with cross-functional teams on program management to meet security and compliance KPIs
• Define critical success factors and KPIs to ensure firm-wide security compliance and security goals are met according to standards-based frameworks
• Monitor KPIs and create dashboards for real-time reports and board presentations
• Collect and analyze business metrics and build dashboards for reporting through data engineering
• Support the automation and governance of HRT’s critical security controls, encompassing:
• Vendor risk management
• Penetration testing
• Access management
• Ensure timely and accurate responses to requests for company data in collaboration with Compliance and Legal 

Qualifications

• 7+ years of experience in cybersecurity risk and/or compliance with significant experience at a company in a heavily regulated industry
• Software development and/or scripting experience, preferably in Python or Go
• Familiarity with standards-based security frameworks such as CIS, NIST-CSF, FedRAMP, or ISO
• Data analysis skills leveraging SQL, Elastic, OSQuery, and Prometheus preferred
• Experience building strong cross-functional relationships and working across multiple teams, both technical and non-technical
• Experience with Linux and comfortability on the command line (Debian is a huge plus!)
• Familiarity with financial industry regulations
• CISSP, CISM, or a similar certification is a plus

The estimated base salary range for this position is 200,000 to 300,000 USD per year (or local equivalent). The base pay offered may vary depending on multiple individualized factors, including location, job-related knowledge, skills, and experience. This role will also be eligible for discretionary performance-based bonuses and a competitive benefits package.

The Customer Success Manager II is responsible for driving long-term success and growth across a strategic portfolio of enterprise customers. This role serves as the primary business partner and trusted advisor to senior stakeholders, ensuring an exceptional customer experience, strong net revenue retention, high product adoption, and advocacy.

As the key point of contact for Diligent’s solutions, the CSM II leads proactive account management, orchestrates cross-functional resources, and partners closely with Sales and Services to deliver measurable outcomes and expand our footprint within each account.

Key Responsibilities

• Own a portfolio of enterprise accounts with accountability for renewal, net revenue retention, and expansion, leveraging data and insights to proactively manage risk and opportunity.
• Drive product adoption and value realization by developing and executing customer success plans aligned to the customer’s strategic objectives and key outcomes.
• Deliver a best-in-class customer experience across all phases of the customer lifecycle, from onboarding through renewal, coordinating with Implementation, Professional Services, Support, Product, and other internal teams.
• Lead executive-level engagements, including QBRs/EBRs and strategic reviews with C-suite, board administrators, and senior directors, to demonstrate ROI, influence adoption, and surface new opportunities.
• Identify, qualify, and partner on expansion opportunities in close collaboration with the Expansion Sales team, ensuring smooth handoffs, aligned account strategies, and clear growth plans.
• Facilitate successful onboarding and rollout of Diligent products and modules, working alongside the Implementation team to ensure stakeholder alignment, training, and effective change management.
• Build and maintain strong, multi-threaded relationships with key business and technical stakeholders, becoming a trusted advisor who understands their governance, risk, compliance, and operational priorities.
• Act as the voice of the customer internally, providing structured feedback and insights to Product, Marketing, Services, and Operations to influence roadmap and process improvements.
• Monitor account health and usage leveraging dashboards and analytics, intervening early to address risks, drive adoption, and reinforce value.
• Champion customer advocacy, by identifying referenceable customers, case study opportunities, testimonials, and participation in user groups or events.
• Collaborate on process and playbook improvements within the Customer Success organization to drive consistency, scalability, and excellence in how we serve enterprise customers.

Required Experience & Skills

• 5+ years of professional experience, including 2–4+ years in Customer Success, Account Management, or a similar client-facing role within B2B SaaS.
• Proven experience managing mid-market and/or enterprise accounts, with comfort engaging senior and executive stakeholders (Director, VP, C‑Suite).
• Demonstrated track record of meeting or exceeding renewal, retention, and expansion targets.
• Strong experience using CRM tools (preferably Salesforce) to manage accounts, opportunities, and customer health activities.
• Excellent communication and presentation skills, able to translate complex concepts into clear, compelling narratives for multiple stakeholder groups.
• Strong consultative and problem-solving skills, with a natural curiosity about the customer’s business, use cases, and success metrics.
• High level of resilience, ownership, and accountability, with the ability to navigate ambiguity and manage competing priorities across a large book of business.
• Passion for technology and a solution-centric mindset, with the ability to quickly learn new products and articulate their business value.
• Strong organizational skills and attention to detail, with experience managing multiple customers, projects, and deadlines simultaneously.

Preferred Qualifications

• Experience in governance, risk, compliance, legal, or adjacent enterprise software environments is a plus.
• Background working in a matrixed, global organization with cross-functional partners across time zones.
• Familiarity with customer success platforms and data-driven approaches to managing account health and adoption.

The Role

We are looking for an Associate Director, Third-Party Risk Management (TPRM) to own the TPRM pillar at Flex. This is not a program management role. It is a pillar ownership role: you set the risk posture, define the operating model, and are accountable for outcomes across a vendor population that touches every part of the business.

You will lead a small team, establish the direction for how Flex evaluates and monitors third-party risk, and make the calls on where speed and rigor need to be balanced. You will design AI-enabled workflows that scale the team's capacity without sacrificing auditability or regulatory defensibility. And you will hold Flex's third-party risk position across the organization, shaping decisions in Product, Engineering, Finance, and Procurement rather than responding to requests from them.

This role is right for someone who has owned TPRM at a mature, regulated institution and also built something from the ground up at a high-growth fintech. Someone comfortable with ambiguity, confident in their risk judgment, and ready to be handed the reins.

What You’ll Do

1. Own Flex's third-party risk posture end-to-end: set the strategy, define the operating model, and be accountable for outcomes across the full vendor population
2. Establish and maintain the policies, standards, and governance framework that underpin TPRM across the organization
3. Make risk-based decisions on vendor approvals, exceptions, and escalations, including explicit tradeoffs between speed and risk exposure, and defend those positions to senior leadership and regulators
4. Architect scalable intake, tiering, due diligence, and monitoring workflows, designing AI-enabled automation where it improves speed and consistency without removing human judgment from consequential decisions
5. Build signal-driven monitoring systems that surface vendor risk in real time (financial distress, security incidents, operational failures) rather than relying on calendar-based review cycles
6. Design and own AI workflows for high-volume tasks like SOC report analysis, questionnaire scoring, and exception tracking, with clear auditability and human-in-the-loop checkpoints throughout
7. Drive risk alignment across Product, Engineering, Finance, and Procurement, shaping vendor strategy and sourcing decisions upstream rather than reviewing them after the fact
8. Serve as Flex's authoritative voice on third-party risk in regulatory exams, audits, and customer due diligence requests
9. Own the reporting framework that gives senior leadership real-time, decision-relevant visibility into third-party risk posture
10. Proactively identify emerging third-party risks across new vendor categories, evolving threat landscapes, and regulatory developments, and evolve controls before they become issues
11. Help mentor and develop more junior team members as the program and team scale

What We’re Looking For

• 7+ years of experience in third-party risk, vendor risk, or a closely related risk and compliance discipline
• Experience at both a large, regulated institution with a mature risk function and a high-growth, venture-backed fintech or technology company
• Demonstrated track record of making and defending risk-based decisions under ambiguity, including explicit speed-vs-risk tradeoffs
• Experience designing AI-enabled workflows for risk or compliance use cases, with a clear point of view on where automation helps and where human oversight is non-negotiable
• Strong working knowledge of vendor risk domains: security, privacy, operational, financial, and regulatory
• Proven ability to influence across Product, Engineering, and Finance, not just within a compliance or risk silo
• Strong communication skills; able to translate complex risk positions into clear recommendations for executive and board-level audiences
• Comfort with data; SQL experience or the ability to query and analyze data independently is a strong plus
• Experience supporting or leading regulatory exams in a financial services or fintech environment

Nice to Have

• Experience building a TPRM program from scratch at a high-growth company
• Familiarity with GRC platforms and common TPRM tooling
• Working knowledge of relevant frameworks and standards (SOC 2, ISO 27001, NIST, PCI, etc.)
• Prior people management or team lead experience

Flex takes a market-based approach to pay, ensuring compensation is commensurate with a candidate's experience and our internal leveling guidelines. For candidates located in our Tier 1 markets (NYC/ SF), the base salary pay range for this role is $176,000—$220,000 USD. For all other U.S. locations, Flex utilizes a geographic pay differential based on a cost of labor index. If you are located outside of the Tier 1 states listed above, your starting pay will be adjusted to align with the market conditions of your specific geographic zone. Please speak with your recruiter for additional information regarding the specific range for your location.

About Flex

Flex is a venture-backed fintech company helping businesses manage and optimize their spend with modern financial products and software. We partner with some of the most innovative companies in the world and operate in a highly regulated, fast-growing environment. As we continue to scale, building best‑in‑class risk and compliance programs is critical to enabling our growth.

The Role

We are looking for an Associate Director, Third-Party Risk Management (TPRM) to own the TPRM pillar at Flex. This is not a program management role. It is a pillar ownership role: you set the risk posture, define the operating model, and are accountable for outcomes across a vendor population that touches every part of the business.

You will lead a small team, establish the direction for how Flex evaluates and monitors third-party risk, and make the calls on where speed and rigor need to be balanced. You will design AI-enabled workflows that scale the team's capacity without sacrificing auditability or regulatory defensibility. And you will hold Flex's third-party risk position across the organization, shaping decisions in Product, Engineering, Finance, and Procurement rather than responding to requests from them.

This role is right for someone who has owned TPRM at a mature, regulated institution and also built something from the ground up at a high-growth fintech. Someone comfortable with ambiguity, confident in their risk judgment, and ready to be handed the reins.

What You’ll Do

1. Own Flex's third-party risk posture end-to-end: set the strategy, define the operating model, and be accountable for outcomes across the full vendor population
2. Establish and maintain the policies, standards, and governance framework that underpin TPRM across the organization
3. Make risk-based decisions on vendor approvals, exceptions, and escalations, including explicit tradeoffs between speed and risk exposure, and defend those positions to senior leadership and regulators
4. Architect scalable intake, tiering, due diligence, and monitoring workflows, designing AI-enabled automation where it improves speed and consistency without removing human judgment from consequential decisions
5. Build signal-driven monitoring systems that surface vendor risk in real time (financial distress, security incidents, operational failures) rather than relying on calendar-based review cycles
6. Design and own AI workflows for high-volume tasks like SOC report analysis, questionnaire scoring, and exception tracking, with clear auditability and human-in-the-loop checkpoints throughout
7. Drive risk alignment across Product, Engineering, Finance, and Procurement, shaping vendor strategy and sourcing decisions upstream rather than reviewing them after the fact
8. Serve as Flex's authoritative voice on third-party risk in regulatory exams, audits, and customer due diligence requests
9. Own the reporting framework that gives senior leadership real-time, decision-relevant visibility into third-party risk posture
10. Proactively identify emerging third-party risks across new vendor categories, evolving threat landscapes, and regulatory developments, and evolve controls before they become issues
11. Help mentor and develop more junior team members as the program and team scale

What We’re Looking For

• 7+ years of experience in third-party risk, vendor risk, or a closely related risk and compliance discipline
• Experience at both a large, regulated institution with a mature risk function and a high-growth, venture-backed fintech or technology company
• Demonstrated track record of making and defending risk-based decisions under ambiguity, including explicit speed-vs-risk tradeoffs
• Experience designing AI-enabled workflows for risk or compliance use cases, with a clear point of view on where automation helps and where human oversight is non-negotiable
• Strong working knowledge of vendor risk domains: security, privacy, operational, financial, and regulatory
• Proven ability to influence across Product, Engineering, and Finance, not just within a compliance or risk silo
• Strong communication skills; able to translate complex risk positions into clear recommendations for executive and board-level audiences
• Comfort with data; SQL experience or the ability to query and analyze data independently is a strong plus
• Experience supporting or leading regulatory exams in a financial services or fintech environment

Nice to Have

• Experience building a TPRM program from scratch at a high-growth company
• Familiarity with GRC platforms and common TPRM tooling
• Working knowledge of relevant frameworks and standards (SOC 2, ISO 27001, NIST, PCI, etc.)
• Prior people management or team lead experience

Flex takes a market-based approach to pay, ensuring compensation is commensurate with a candidate's experience and our internal leveling guidelines. For candidates located in our Tier 1 markets (NYC/ SF), the base salary pay range for this role is $176,000—$220,000 USD. For all other U.S. locations, Flex utilizes a geographic pay differential based on a cost of labor index. If you are located outside of the Tier 1 states listed above, your starting pay will be adjusted to align with the market conditions of your specific geographic zone. Please speak with your recruiter for additional information regarding the specific range for your location.

The Role

We are looking for an Associate Director, Third-Party Risk Management (TPRM) to own the TPRM pillar at Flex. This is not a program management role. It is a pillar ownership role: you set the risk posture, define the operating model, and are accountable for outcomes across a vendor population that touches every part of the business.

You will lead a small team, establish the direction for how Flex evaluates and monitors third-party risk, and make the calls on where speed and rigor need to be balanced. You will design AI-enabled workflows that scale the team's capacity without sacrificing auditability or regulatory defensibility. And you will hold Flex's third-party risk position across the organization, shaping decisions in Product, Engineering, Finance, and Procurement rather than responding to requests from them.

This role is right for someone who has owned TPRM at a mature, regulated institution and also built something from the ground up at a high-growth fintech. Someone comfortable with ambiguity, confident in their risk judgment, and ready to be handed the reins.

What You’ll Do

1. Own Flex's third-party risk posture end-to-end: set the strategy, define the operating model, and be accountable for outcomes across the full vendor population
2. Establish and maintain the policies, standards, and governance framework that underpin TPRM across the organization
3. Make risk-based decisions on vendor approvals, exceptions, and escalations, including explicit tradeoffs between speed and risk exposure, and defend those positions to senior leadership and regulators
4. Architect scalable intake, tiering, due diligence, and monitoring workflows, designing AI-enabled automation where it improves speed and consistency without removing human judgment from consequential decisions
5. Build signal-driven monitoring systems that surface vendor risk in real time (financial distress, security incidents, operational failures) rather than relying on calendar-based review cycles
6. Design and own AI workflows for high-volume tasks like SOC report analysis, questionnaire scoring, and exception tracking, with clear auditability and human-in-the-loop checkpoints throughout
7. Drive risk alignment across Product, Engineering, Finance, and Procurement, shaping vendor strategy and sourcing decisions upstream rather than reviewing them after the fact
8. Serve as Flex's authoritative voice on third-party risk in regulatory exams, audits, and customer due diligence requests
9. Own the reporting framework that gives senior leadership real-time, decision-relevant visibility into third-party risk posture
10. Proactively identify emerging third-party risks across new vendor categories, evolving threat landscapes, and regulatory developments, and evolve controls before they become issues
11. Help mentor and develop more junior team members as the program and team scale

What We’re Looking For

• 7+ years of experience in third-party risk, vendor risk, or a closely related risk and compliance discipline
• Experience at both a large, regulated institution with a mature risk function and a high-growth, venture-backed fintech or technology company
• Demonstrated track record of making and defending risk-based decisions under ambiguity, including explicit speed-vs-risk tradeoffs
• Experience designing AI-enabled workflows for risk or compliance use cases, with a clear point of view on where automation helps and where human oversight is non-negotiable
• Strong working knowledge of vendor risk domains: security, privacy, operational, financial, and regulatory
• Proven ability to influence across Product, Engineering, and Finance, not just within a compliance or risk silo
• Strong communication skills; able to translate complex risk positions into clear recommendations for executive and board-level audiences
• Comfort with data; SQL experience or the ability to query and analyze data independently is a strong plus
• Experience supporting or leading regulatory exams in a financial services or fintech environment

Nice to Have

• Experience building a TPRM program from scratch at a high-growth company
• Familiarity with GRC platforms and common TPRM tooling
• Working knowledge of relevant frameworks and standards (SOC 2, ISO 27001, NIST, PCI, etc.)
• Prior people management or team lead experience

Flex takes a market-based approach to pay, ensuring compensation is commensurate with a candidate's experience and our internal leveling guidelines. For candidates located in our Tier 1 markets (NYC/ SF), the base salary pay range for this role is $176,000—$220,000 USD. For all other U.S. locations, Flex utilizes a geographic pay differential based on a cost of labor index. If you are located outside of the Tier 1 states listed above, your starting pay will be adjusted to align with the market conditions of your specific geographic zone. Please speak with your recruiter for additional information regarding the specific range for your location.

About Zone & Co: 

Zone & Co is on a mission to empower finance professionals to drive strategic growth through seamless, intelligent operations. We build cloud-native software solutions on Oracle NetSuite, automating complex financial processes like billing, accounts payable, reporting, and reconciliation. Our vision is to unlock the full strategic potential of finance by infusing the ERP with the intelligence and automation needed for truly transformative operations. Join our rapidly growing team as we redefine financial efficiency for scaling businesses worldwide.

The Role: We are seeking a meticulous and proactive Security and Privacy Compliance Analyst to help safeguard our organization and our customers' data. Reporting directly to the Director of IT, Security and Compliance, you will play a critical role in maturing our governance, risk, and compliance (GRC) programs. In this position, you will bridge the gap between technical security controls and regulatory requirements, ensuring that Zone & Co's rapidly expanding suite of financial software maintains the highest standards of data protection and privacy.

This role requires a strong foundational knowledge of major security frameworks and privacy regulations, a keen eye for detail in auditing internal processes, and the ability to clearly communicate compliance postures to both internal engineering teams and enterprise customers.

Essential Job Functions:

• Compliance Framework Governance: Lead the management and continuous scaling of Zone & Co’s core security compliance frameworks, specifically SOC 2 Type II and ISO 27001.
• Privacy Operations Leadership: Govern global data privacy operations to ensure strict, ongoing alignment with GDPR, CCPA/CPRA, and other emerging data protection laws.
• Customer Trust & Revenue Enablement: Serve as the primary security liaison for enterprise customers, directly supporting the sales cycle by demonstrating and communicating a robust, mature security posture.
• Risk & Audit Management: Manage the organization's internal audit program and oversee the third-party vendor risk lifecycle to proactively identify and mitigate vulnerabilities.

Responsibilities, Duties, and Tasks:

• Audit Coordination: Coordinate evidence collection, manage project timelines, and partner directly with external auditors during annual compliance assessments.
• Privacy Assessments: Conduct Data Privacy Impact Assessments (DPIAs) for new products and process Data Subject Access Requests (DSARs) within mandated SLAs.
• Questionnaires & Trust Center: Accurately and efficiently complete incoming vendor security questionnaires from prospects and maintain up-to-date documentation in our customer-facing Trust Center.
• Internal Control Testing: Design and execute internal audits to test whether technical and administrative controls are operating effectively. Track control gaps and drive engineering/IT remediation efforts.
• Vendor Risk Reviews: Evaluate the security and privacy postures of prospective and existing third-party vendors and sub-processors through comprehensive risk assessments.
• Policy & Training Development: Draft, update, and publish internal security policies, standard operating procedures (SOPs), and incident response plans. Develop and administer engaging company-wide security and privacy awareness training.

What You'll Bring (Qualifications and Experience):

• Experience: 3+ years of direct experience in IT Audit, Information Security, Privacy Operations, or GRC (Governance, Risk, and Compliance), preferably within a B2B SaaS, FinTech, or cloud technology environment.
• Deep Domain Expertise: Hands-on experience working with established compliance frameworks (SOC 2, ISO 27001) and navigating global privacy legislation (GDPR, CCPA).
• SaaS/Cloud Acumen: A solid understanding of cloud computing architectures (AWS, Azure, GCP) and enterprise software environments. Familiarity with ERP systems (like NetSuite) is a strong plus.
• Analytical & Problem-Solving Skills: Proven ability to translate complex regulatory requirements into actionable, practical controls for IT and engineering teams without stifling innovation.
• Exceptional Communication: Outstanding written and verbal communication skills. You must be able to write clear policies, translate technical risks for business leaders, and confidently answer complex customer security questions.
• Education & Certifications: Bachelor’s degree in Information Systems, Cybersecurity, Business, or a related field. Relevant industry certifications such as CISA, CISM, CIPP/E, CIPP/US, or Security+ are highly preferred.

The Opportunity:

We are seeking an experienced and strategic leader to serve as Director, Information Sciences Governance, Risk & Compliance (IS GRC), reporting directly to the VP, IS Security, Risk, and Compliance. This person will be responsible for leading and maturing the IS GRC program, ensuring that IS governance processes, technology risk management practices, third-party risk management, and compliance activities effectively support business objectives and protect the organization.

As a key leader within Information Sciences, this individual will partner closely with Security, Infrastructure, Enterprise Applications, Data & Analytics, Legal, Privacy, Quality, Finance, HR, Procurement, and other cross-functional stakeholders to establish a scalable and pragmatic IS GRC framework. They will help the organization navigate a dynamic regulatory, technology, and business environment by strengthening controls, driving compliance readiness, improving risk visibility, managing third-party risk, and enabling informed decision-making across IS.

This role is ideal for a leader who can balance strategic program development with operational execution, build trusted partnerships across the organization, and translate regulatory, technical, and control requirements into practical processes that enable the business.

Key Responsibilities:

• IS GRC Program Leadership: Lead and evolve the Information Sciences Governance, Risk & Compliance program, including policies, standards, risk frameworks, compliance processes, and reporting.

• IS Governance: Develop, implement, and maintain governance structures, policies, standards, and procedures to support IS objectives, regulatory obligations, and internal accountability.

• Technology Risk Management: Establish and manage processes to identify, assess, prioritize, track, and report key IS, cybersecurity, data, third-party, and operational risks. Partner with stakeholders to develop mitigation and remediation plans.

• Third-Party Risk Management: Lead and mature the third-party risk management program for Information Sciences, including risk assessment and oversight of vendors, service providers, and technology partners. Partner with Procurement, Legal, Security, Privacy, and business stakeholders to evaluate third-party controls, contractual requirements, and remediation plans to ensure third-party services meet company risk and compliance expectations.

• Compliance Management: Oversee IS compliance initiatives related to applicable laws, regulations, contractual obligations, and internal policies. Coordinate control assessments, compliance reviews, and readiness efforts for audits and inspections.

• Internal Controls: Partner with IS and business teams to design, document, evaluate, and improve IT and IS-related controls and monitor their effectiveness over time.

• Policy and Standards Management: Drive the development, review, communication, and maintenance of IS policies, standards, baselines, and related procedures to ensure consistency, usability, and alignment with company requirements.

• Audit and Assessment Support: Coordinate and support internal and external audits, risk assessments, and evidence requests related to Information Sciences systems, processes, and controls. Track observations and corrective actions through closure.

• Cross-Functional Partnership: Build strong relationships across the business to understand technology risks, compliance obligations, and operational challenges, and to promote a culture of accountability and continuous improvement.

• Metrics and Reporting: Develop meaningful dashboards, metrics, and executive reporting to communicate IS program health, compliance posture, risk trends, and remediation progress to senior leadership.

• Training and Awareness: Promote awareness of IS governance, risk, and compliance responsibilities across Information Sciences and the broader organization through communication, training, and stakeholder engagement.

• Continuous Improvement: Stay informed about emerging regulations, industry trends, and best practices in IT/IS governance, cybersecurity compliance, privacy, and risk management, and incorporate them into program enhancements.

• This person will also coordinate with existing service delivery teams in Information Sciences to ensure that high levels of service and support are maintained.

Required Skills, Experience and Education:

• Bachelor’s degree or equivalent and a minimum of 10+ years of experience in Information Technology, Information Sciences, governance, risk management, compliance, internal audit, cybersecurity compliance, or related functions, including leadership experience in a regulated industry.

• Proven track record of building, managing, and scaling IS or IT GRC programs in complex organizations.

• Experience partnering across IS, security, legal, privacy, quality, procurement, finance, and business teams to drive risk-informed and compliant technology practices.

• Strong understanding of IT governance, technology risk management, internal controls, policy management, third-party risk management, and compliance operations.

• Experience working in regulated environments and with relevant frameworks and requirements such as SOX, GxP, GDPR/CCPA, ISO 27001, HITRUST, cybersecurity, privacy, IT general controls, vendor risk management, and audit readiness, as applicable.

• Experience supporting or leading control design, risk assessments, remediation activities, and audit or certification readiness efforts related to ISO 27001, HITRUST, or other relevant compliance frameworks.

• Ability to translate regulatory, audit, and control requirements into practical, business friendly IS processes, standards, and guidance.

• Entrepreneurial spirit; thrives in a fast-paced, high-growth, midsize company environment.

• Comfortable handling ambiguity and navigating through evolving processes, priorities, and organizational needs.

• Highly organized, with strong attention to detail and accuracy.

• Committed to meeting and exceeding high standards for quality and continuous improvement.

• Builds rapport and credibility as an effective strategic partner.

• Fosters team collaboration, breaks down silos, and is able to influence without authority.

• Skilled at conflict resolution, negotiation, and driving alignment across diverse stakeholder groups.

• Acts with urgency and sound judgment. Enjoys enabling others and solving complex problems.

• Ability to manage multiple initiatives, activities, and priorities simultaneously and autonomously.

• Strong written and verbal communication, presentation, and facilitation skills, with the ability to distill complex information for senior leadership.

Preferred Skills:

• Master’s degree or equivalent in Information Technology, Business, Risk Management, Cybersecurity, or a related field.

• Relevant certifications such as CISA, CISM, CRISC, CISSP, CGEIT, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, HITRUST CCSFP, or similar are preferred.

• Experience leading or supporting ISO 27001 and/or HITRUST implementation, certification, surveillance, or readiness programs is strongly preferred.

• Experience leading or supporting IT/IS governance, cybersecurity compliance, privacy, audit, or risk programs in the pharmaceutical, biotechnology, life sciences, or other highly regulated industries.

• Experience with third-party risk management, policy governance platforms, GRC tooling, control automation, and audit management solutions is a plus.

• Experience developing and operationalizing IS policies, standards, procedures, and control frameworks across enterprise applications, infrastructure, cloud environments, and data platforms is desirable.

• Experience developing executive-level reporting and dashboards for IT or IS risk and compliance programs is desirable.

• Experience standing up or maturing enterprise IT governance, security governance, third-party risk management, or technology compliance monitoring programs is a plus.

• Experience working with cross-functional stakeholders to align security, privacy, compliance, and business requirements into scalable operational processes is preferred. 

  #LI-Hybrid  #LI-YG1

Position Overview

The Senior Corporate Accountant will be primarily responsible for many aspects of the financial statement close process performed at the corporate level, including financial reporting and multi-entity consolidation. This includes ensuring proper application of US GAAP for various processes, such as ASC 842 Leases, ASC 718 Stock Compensation, ASC 470 Debt, ASC 350 Intangibles - Goodwill & Other, ASC 805 Business Combinations, transfer pricing, and other technical accounting matters. The role is pivotal in driving Diligent’s AI-first transformation, ensuring operational excellence, compliance, and scalable growth across all accounting functions.  

This role will also play a key part in identifying opportunities to leverage AI and automation tools to enhance accuracy, streamline recurring workflows, and drive efficiency across the accounting function. The Senior Corporate Accountant will assist with ad-hoc technical accounting projects and have high-visibility within the organization, ensuring that US GAAP is applied correctly for new company-wide initiatives. This role will report to the Senior Director, Corporate Accounting. We are looking for someone who has excellent problem-solving skills, intellectual curiosity about emerging technologies, and enjoys working in a challenging and fast-paced environment to support our continued success.

Key Responsibilities

• Assist in the monthly, quarterly, and annual general ledger closing process by:
• Owning the accounting for equity compensation and incentive awards including grants issued, grant-date valuation, exercises, expense recognition, modifications, and forfeitures, utilizing the Certent Equity Management solution.
• Calculating transfer pricing, preparing journals, and managing cross-border transactions, including preparation of inter-company entries, coordinate review of output with statutory teams, support tax team with transfer pricing documentation.
• Perform accounting for internally developed software in accordance with US GAAP, including capitalization of development costs, amortization, and impairment assessments for both internal-use software and software developed for sale.
• Prepare the necessary journal entries and monthly account reconciliations for accounts including, but not limited to intangible assets, compensation and payroll related items, and deferred commissions and incentives.
• Provide support to revenue recognition team for a smooth revenue recognition process, write offs, recoveries, deferred revenue and runoff, multi-year arrangements, bundled offerings, flux analysis.
• Review journal entries and account reconciliations assigned, perform monthly close activities to ensure accurate and timely financial reporting.
• Financial statement accounts analysis, identification of non-routine transactions, investigate anomalies, and document findings.
• Prepare group and statutory audit workpapers for assigned accounts and disclosures. Support external and statutory audits by preparing schedules, responding to auditor inquiries, and maintaining supporting documentation.
• Provide support or act as accounting lead in enterprise-wide initiatives and assist in other special projects, including but not limited to system upgrades, implementations, and AI-driven process transformations.
• Collaborate cross-functionally with finance, tax, legal, and other operational teams on accounting and reporting matters.
• Obtain and maintain a thorough understanding of the business operations, the financial reporting, and the general ledger structure for all of Diligent’s legal entities, and actively support the consolidation and intercompany elimination process.
• Support in all compliance related matters assigned including, but not limited to, annual financial statement audits, quarterly reporting requirements.
• Provide support or act as accounting lead in enterprise-wide initiatives and assist in other special projects, including but not limited to system upgrades, implementations, and AI-driven process transformations.
• Build strong working relationships with internal stakeholders and contribute to team efficiency through cross-training, sharing responsibilities, and serving as position backup.
• Develop and maintain internal accounting controls, policies, procedures, and process documentation to ensure timely and accurate financial reporting.
• Drive process improvement and automation initiatives by identifying use cases for AI-assisted accounting workflows, testing and validating AI-generated outputs, and helping build scalable, technology-enabled processes across the close cycle.
• When assigned, assist or manage the monthly close for newly acquired entities and support the transition of balance sheet and income statement responsibilities to designated team members.
• Champion the adoption of AI-driven automation and modern platforms to streamline processes, reduce manual effort, and deliver actionable insights.
• Drive the integration of AI and automation in key accounting processes (e.g., account reconciliations, procure-to-pay, financial statement reviews, cash forecasting, and T&E), freeing teams for higher-value work. 
• Perform ad-hoc projects as assigned.

Required Experience/Skills

• Bachelor’s degree in accounting; CPA required.
• Strong knowledge of U.S. GAAP required.
• Minimum of 3 years of progressive accounting experience, Big 4 and SaaS industry experience preferred.
• Knowledge of NetSuite or similar accounting systems. Familiarity with AI-assisted tools and a willingness to adopt emerging technologies in an accounting context is a plus.
• Experienced with accounting concepts related to the software industry, international accounting, multi-entity consolidation, and debt & equity accounting is preferred.
• Strong written and oral communication skills with the ability to work cross-functionally and cross-geography and relate effectively across all levels of staff.
• Hands-on, energetic, organized, team player with proven ability to adapt quickly in a changing environment and facilitate change, multitask effectively and work independently.
• Ability to prioritize competing projects and analyze processes to simplify, automate, and improve them, including the use of AI and other emerging technologies.
• Excellent attention to detail, strong business ethics, and demonstrated ability to handle confidential information.

About the Role:

The GRC Analyst, Federal & Customer Programs is responsible for the hands-on analysis, documentation, and operational execution of the company's security governance, risk, and compliance obligations. This role sits at the intersection of customer contracts, regulatory frameworks, and the company's security control environment — translating external requirements into clear, traceable internal commitments and evaluating how well current capabilities satisfy them. The GRC Analyst reviews incoming contractual security language, maps obligations to applicable frameworks and existing controls, produces compliance matrices and gap analyses, owns the operational risk assessment process, contributes to governance and policy lifecycle activities, and supports audit, assessment, and customer inquiry activities.

A meaningful portion of this role is dedicated to ongoing contract and requirements analysis as new programs are awarded and existing programs evolve. The GRC Analyst serves as the security function's primary reviewer of incoming contractual cybersecurity language and works directly with legal and sourcing on flow-down negotiation and redlines. Candidates who enjoy careful reading of contractual and regulatory text — and who want this to be a substantial part of their day-to-day work — will find this role a strong fit.

This is a detail-oriented, writing-intensive role requiring strong analytical judgment, fluency across multiple compliance frameworks, and the ability to work effectively with legal, sourcing, program management, engineering, and security operations stakeholders.

Key Responsibilities:

Contract & Requirements Analysis

• Review customer contracts, statements of work, security annexes, CDRLs, data protection addenda, and flow-down clauses to identify cybersecurity, privacy, and information handling obligations applicable to the company.
• Extract and catalog specific security requirements from contractual language, and translate them into structured, testable statements suitable for traceability and control mapping.
• Compare identified requirements against the company's current product scope, control environment, and certification posture to determine where compliance is already met, partially met, or requires new implementation work.
• Produce gap analyses, compliance matrices, and Requirements Traceability Matrix (RTM) artifacts that clearly communicate the state of compliance for a given contract, program, or system.
• Serve as the security function's primary point of contact for legal and sourcing during contract review, redline cycles, and flow-down negotiation, including review of subcontractor and supplier flow-down language.

Framework Mapping & Interpretation

• Maintain working proficiency across the frameworks relevant to the company's regulatory and contractual posture, including NIST SP 800-171, NIST SP 800-53, NIST CSF, CMMC, ISO 27001, FedRAMP, and applicable European frameworks such as NIS2 and GDPR.
• Map controls across frameworks to minimize duplicated work and enable consistent responses to overlapping requirements; contribute to a shared control inventory used by compliance, security, and program teams.
• Interpret framework language and authoritative guidance (NIST publications, DoD guidance, regulator FAQs) in the context of specific company systems and business scenarios and escalate ambiguity for formal risk decisions when appropriate.

Governance, Policy & ISMS Support

• Contribute to the maintenance of the company's Information Security Management System (ISMS) documentation set, including keeping control descriptions, evidence references, and scope statements accurate and current.
• Support the policy and standard lifecycle, including periodic review cycles, version control, exception governance, and clarification of control owner accountability.
• Produce compliance posture reporting and audit readiness metrics for governance forums and leadership review, including framework coverage, finding aging, and remediation progress.

Deliverable Writing & Artifact Contribution

• Draft and revise compliance deliverables including System Security Plans (SSP), Plans of Action & Milestones (POA&M), policy and standard content, control narratives, customer security questionnaire responses, and audit artifacts.
• Author clear, concise written responses to customer, auditor, and regulator inquiries, calibrated to the technical level of the audience and consistent with approved company positioning.

Risk Assessment & Treatment

• Own the operational risk assessment process and the supporting risk register, including conducting periodic and event-driven risk assessments, documenting current state, identifying deficiencies, and developing risk treatment recommendations.
• Route risk acceptance and exception decisions to the appropriate decision authority with the underlying analysis and documentation prepared for review; track decisions and ensure follow-through on conditions or expirations.
• Track open compliance findings and remediation activities, prepare status updates, and flag aging or high-severity items for escalation.

Third-Party & Supply Chain Risk

• Contribute to vendor and supplier security review activities, including evaluating vendor security questionnaires, reviewing supplier control attestations, and assessing residual risk for inclusion in procurement and program decisions.
• Support assessment of subcontractor and supplier flow-down compliance, including coordinating with sourcing and program management on supplier security obligations and remediation.

Audit & Assessment Support

• Support internal and external audit, assessment, and certification activities, including C3PAO engagements, ISO 27001 surveillance audits, customer assessments, and regulator inquiries.
• Coordinate evidence collection with system owners and control operators; validate that evidence is accurate, complete, and appropriately scoped before submission.
• Participate in assessor and auditor interviews as a subject matter contributor on specific controls and artifacts.

Cross-Functional Collaboration

• Partner with legal and sourcing on contract review, redlines, and flow-down language; with security program management on milestones, schedules, and audit coordination; and with security engineering and IT on evidence, control implementation detail, and remediation planning.
• Serve as a knowledgeable point of contact for internal teams seeking to understand what a given regulatory or contractual requirement means in practice.

What Success Looks Like in Year One

• Established a repeatable contract review intake process with legal and sourcing, including a maintained library of standard cybersecurity flow-down clauses and review turnaround expectations.
• Produced an end-to-end Requirements Traceability Matrix for at least one active federal program, traceable from contract clauses through framework controls to evidence sources.
• Stood up the operational risk register and routine risk reporting cadence, with at least one full assessment cycle completed and risk treatment decisions documented.
• Maintained the ISMS documentation set in audit-ready condition through at least one external assessment or surveillance cycle.

Required Qualifications:

• Five or more years of progressive experience in cybersecurity governance, risk, and compliance; IT audit; or a closely related discipline, with substantial hands-on exposure to framework interpretation and contract requirement analysis.
• Demonstrated working knowledge of NIST SP 800-171 and NIST SP 800-53, including control families, assessment procedures, and common implementation patterns.
• Experience contributing to SSP and POA&M artifacts, compliance matrices, or Requirements Traceability Matrices in a regulated environment.
• Practical experience supporting at least one formal audit, certification, or assessment cycle (for example CMMC, ISO 27001, SOC 2, FedRAMP, or comparable).
• Strong technical writing skills, including the ability to produce accurate, concise, and audience-appropriate compliance documentation. Writing samples may be requested as part of the interview process.
• Demonstrated comfort and interest in reading contractual and regulatory language carefully and translating it into specific, actionable internal requirements. This is a core part of the role, not an occasional task.
• Comfort working across multiple stakeholder groups — legal, sourcing, engineering, IT, security operations, and program management — and adjusting communication style accordingly.
• Bachelor's degree in Information Security, Information Systems, Business, a related field, or equivalent practical experience.

Preferred Qualifications:

• Direct experience with CMMC 2.0 assessment preparation, including familiarity with DFARS 252.204-7012 and 48 CFR Part 204.
• Familiarity with ISO 27001, FedRAMP, SOC 2, NIS2, GDPR data security obligations, or EU dual-use export control regimes.
• Experience handling Controlled Unclassified Information (CUI) in accordance with NARA and DoD requirements.
• Exposure to aerospace, defense, space, or other regulated technology environments.
• Experience reviewing or negotiating cybersecurity flow-down language in customer or supplier contracts.
• Working familiarity with Governance, Risk, and Compliance (GRC) tooling such as ServiceNow GRC, Archer, Hyperproof, Drata, Vanta, or equivalent.
• Industry certifications such as CISA, CRISC, CISSP, CGRC (formerly CAP), ISO 27001 Lead Implementer / Lead Auditor, CMMC Registered Practitioner (RP), or CMMC Certified Professional / Certified Assessor (CCP / CCA).
• Active US security clearance, or eligibility to obtain one.

Spire operates a hybrid work model, and this position will require you to work a minimum of three days per week in the office.

Access to US export-controlled software and/or technology may be required for this role. If needed, Spire will arrange the necessary licenses—this is not something candidates need to have before applying. #LI-DC1

Team (Project) Introduction 

The VA OIT SPM, Corporate (CORP) Service Line (SL) delivers world-class, Veteran-centric capabilities that provide secure, seamless delivery of IT systems to VA corporate offices so these offices may efficiently and effectively provide benefits and services to Veterans and their families.

Professional Level 

The Security Analyst aligns with an E2 professional level.  An Engineer 2 has a good understanding of the software development life cycle and can take on work without much direction majority of the time. Performs multiple engineering-related tasks in various assignments within the project and firm. An Engineer 2 has broad knowledge of engineering procedures and assists in the resolution of complex problems. An Engineer 2 has strong technical skills and background, a knack for learning new technologies, and a blend of good problem-solving and innovation needed to resolve a wide variety of technical production challenges. 

Responsibilities 

• Support Authorization to Operate (ATO) processes for VA systems by updating and maintaining security documentation, including System Security Plans (SSP), Plan of Action & Milestones (POA&M), Incident Response Plans (IRP), and Business Impact Analyses (BIA).
• Perform continuous monitoring and vulnerability management using tools like Tenable Nessus, SCCD, and adherence to DISA STIGs.
• Conduct risk assessments and ensure compliance with NIST Risk Management Framework (RMF) and FEDRAMP requirements for cloud systems.
• Coordinate and execute annual ATO-related exercises such as Disaster Recovery, Contingency Planning, and Incident Response Tabletop tests with cross-functional stakeholders.
• Ensure timely remediation of vulnerabilities and track mitigation progress in eMASSService Now (SNOW) Continuous Authorization and Monitoring (CAM), collaborating with DevOps and system owners.
• Develop and review Memorandums of Understanding (MOUs), Interconnection Security Agreements (ISAs), Privacy Threshold Analyses (PTAs), and Privacy Impact Assessments (PIAs).
• Provide security analysis and technical support for VA Corporate Service Line systems such as VEMS, POS, and MDM across their lifecycle.
• Support VA’s compliance with government standards (FISMA, HIPAA, NIST SP 800-53, and VA-specific directives). 

Requirements 

• Bachelors degree in computer science, electronics engineering or other engineering or technical discipline is required.
• 5+ years of experience in a security analyst, system steward, or similar role, supporting government information technology systems.
• Expertise in federal Governance, Risk, and Compliance (GRC) tools such as Service Now (SNOW), Continuous Authorization and Monitoring (CAM) or Enterprise Mission Assurance Support Service (eMASS) 

The application window will be open until at least May 11, 2026. This opportunity will remain online based on business needs which may be before or after the specified date.

This role is not eligible for immigration sponsorship.

The Technology Governance, Risk, and Compliance (GRC) team at GFiber establishes the framework that ensures our technology operations manage risks effectively and align with industry best practices. As GFiber navigates a complex corporate separation, our environment requires agility and an AI-native mindset. We partner across Engineering, Operations, Security, Legal, and other business units to embed GRC principles into our evolving systems. Our work protects GFiber assets and customer trust while accelerating business velocity during this critical transition.

Role Description

In this GRC role, you will take ownership of evolving our Third-Party Risk Management (TPRM) processes and driving tactical automation across the team. We are looking for a highly proactive self-starter who thrives in ambiguity and operates with exceptional agency. You will identify opportunities to integrate AI into daily operations to streamline GRC tooling and workflows. You will also distill complex technical risks into clear executive presentations for senior leadership and the C-suite. Your tenacity and project-driving capabilities will directly enable GFiber to scale securely during our separation.

In this role, you'll:

• Take full ownership of evolving and maintaining GFiber TPRM processes to optimize our existing tooling platform. Translate complex technical and non-technical risks into actionable insights for diverse stakeholders.
• Identify and execute tactical opportunities to automate GRC workflows using an AI-native approach. 
• Apply key cybersecurity frameworks, specifically ISO 27001 and NIST CSF, to manage and mature our risk posture. Act as a proactive project driver by tracking technical inquiries and moving initiatives forward without waiting for direction.
• Draft clear and effective risk presentations for senior leadership and C-suite executives. 
• Support M&A and corporate carve-out initiatives by aligning GRC processes with our new operational reality.

At a minimum we'd like you to have:

• Bachelor's degree in Accounting, Finance, MIS or Computer Science or equivalent practical experience.
• 5 years of experience building, maintaining, and evolving Third-Party Risk Management programs and processes.
• Proven ability to design and implement right-sized security controls that balance risk reduction with business velocity and our specific operational environment.
• Experience taking an AI-native approach to problem solving and tactical automation within security or risk teams.
• Professional certifications such as CISA, CRISC, CISSP, or CISM.

It's preferred if you have:

• Experience supporting M&A activity or corporate separations.
• Proven ability to draft and deliver presentations directly to C-suite executives and senior leadership.
• Familiarity with scaling GRC practices outside of legacy parent structures.
• Demonstrated track record of high agency and proactive project execution in fast-paced environments.
• Written and verbal communication skills with the ability to articulate risk clearly to varied audiences.

The US base salary range for this full-time position is between $117,600 - $172,500 + bonus + cash award + benefits. As pay varies by location, your recruiter will share more about the specific salary range for your targeted location during the hiring process.

#LI-DNI

Position Overview 

The Field Marketing Manager, Americas will own and scale the field marketing engine for a high-impact business unit, directly influencing pipeline growth, accelerating revenue, and shaping how we go to market across the region.

This is a highly visible role that blends strategy and execution. You’ll design and orchestrate integrated campaigns, events, webinars, and ABM programs; working side-by-side with Sales and cross-functional Marketing teams to turn ideas into measurable business outcomes.

If you’re equal parts strategist, operator, and innovator; and excited to leverage AI to unlock smarter, faster marketing - this role is for you.

As a senior individual contributor on the Americas Field Marketing team, this person will: 

• Lead the development and execution of pod-level field marketing plans aligned to regional and business unit goals. 

• Partner closely with Sales to identify and activate priority plays that progress opportunities through the funnel and into bookings. 

• Build scalable field marketing programs and infrastructure, leveraging AI to improve efficiency, targeting and insights. 

• Shape team-wide processes and workflows and provide day-to-day guidance and coaching to Field Marketing Specialists and Senior Specialists, exerting influence without formal authority. 

Key Responsibilities

Strategy & Planning 

Own the field marketing strategy and annual plan for an assigned Americas pod or business unit, aligned to shared MQL, pipeline and bookings targets. 

Translate GTM plays and regional priorities into integrated field programs that pull the right marketing levers at the right time across the customer journey. 

Use data, insights and AI tools to seize opportunities, refine targeting, and continuously optimize program mix and investment. 

Campaigns, Events & ABM 

Design and execute multi-channel field campaigns, including events, webinars, ABM motions and localized programs that support both new logo and expansion goals. 

Own end-to-end delivery of field marketing activities — brief development, project management, enablement, execution and debriefs — with extreme attention to detail and operational rigor. 

Partner with Demand Generation, Product Marketing, Brand, and Corporate Events to ensure Americas field programs are on-brand, on-message and coordinated across channels. 

Sales & Cross-Functional Partnership 

Build strong, trust-based relationships with Sales leaders and AEs in the assigned pod/region; act as the primary marketing counterpart for planning and performance reviews. 

Align on coverage models, territories, key accounts and follow-up expectations with BDR/SDR teams; ensure smooth handoffs from MQL to opportunity and into bookings. 

Collaborate with other Field Marketing Managers across Americas to share best practices, standardize processes and identify opportunities to scale what works. 

AI-Enabled Execution & Innovation 

Champion the use of AI across field marketing workflows — from audience and target account list refinement to content creation, testing and reporting — to increase throughput and impact. 

Pilot new AI-driven tactics in partnership with Brand, Content and Demand Generation, and document learnings to inform broader adoption. 

Measurement, Reporting & Optimization 

Own pod-level field targets and KPIs; track and report on MQLs, opportunities, pipeline and bookings influenced by field programs, as well as marketing ROI. 

Build regular performance readouts for Sales and Marketing leadership, surfacing insights, risks and recommended optimizations. 

Use data to identify gaps in the funnel, propose corrective actions, and test alternative approaches to unlock growth. 

Required Experience/Skills 

• 5+ years of B2B SaaS field marketing or closely related experience (e.g., growth, revenue, campaign marketing), with a track record of driving pipeline and bookings with Sales. 

• Deep experience building and executing integrated field programs across tactics such as events, webinars, ABM and partner campaigns. 

• Demonstrable capability with AI tools, with real use cases that improve operational excellence, visibility and speed-to-impact in marketing programs. 

• Motivated self-starter with a “get stuff done” mindset and the ability to set priorities, manage multiple projects and hit deadlines with limited oversight. 

• Strong interpersonal and communication skills (written and verbal), including comfort presenting to and influencing senior Marketing and Sales leaders. 

• Proven ability to partner and develop strong relationships across all levels of a complex, matrixed commercial organization. 

• Highly organized, process-driven operator with strong project management skills and extreme attention to detail. 

• Commercial, strategic and data-driven mindset; uses data and reporting to make decisions, optimize plans and demonstrate impact against regional growth goals. 

• Proficiency with core marketing and productivity tools (e.g., Salesforce, Marketo, Wrike, Microsoft Office Suite) and comfort adopting new AI-powered technologies. 

• Familiarity with the GRC space and experience working in a complex matrixed organization are strong pluses. 

#LI-SR1

The role:
The Technology and Cybersecurity risk and controls team handles a wide range of cross-functional activities, from security compliance certifications and audits, to risk management, inbound and outbound due diligence, third party risk management, security awareness, policy and procedures, and more.

Each of these ongoing parallel activities entails interpreting and setting requirements, assessing the effectiveness of security controls, risk-based decision making, cross-functional collaboration and communication, and staying up-to-date on security best practices and how changes in the evolving threat landscape need to inform our strategy.

We are seeking an experienced Security Compliance Manager responsible for monitoring and governing security controls in the cloud based on regulatory/compliance requirements and industry standards for our core Banking platform. Candidate must be able to assimilate knowledge quickly, understand stakeholder’s business challenges/risks, and act as a trusted advisor to lead change, policy adoption and monitor compliance against policies and standards.

What you'll do:

• Own bank compliance and controls testing, monitoring and issue management

• Manage ongoing investor audits like SOC2, PCI DSS, SOX ITGC, GLBA and security due diligence questionnaires

• Serve as the primary liaison between internal stakeholders (i.e. Cybersecurity,

• Technology, Product, Risk, Privacy, Internal Audit, HR, Legal, Sales etc…) and external auditors, regulators, and third-party assessors

• Monitor compliance with cybersecurity policies and standards and assess security compliance risks for bank scoped products, processes and technologies in a cloud environment

• Partner with stakeholders to conduct walkthroughs and create process maps for critical cybersecurity processes, facilitating in risk and control identification and ensure the environment is operating safely and in control

• Translate technical controls and requirements into audit-ready evidence, and work with technical teams to align implementations with compliance expectations

• Support regulatory, third party attestation, and Internal Audit, audit readiness activities, ensuring control design and execution meet internal policy and external regulatory standards

• Communicate clearly and effectively with both technical and non-technical audiences, including executives, control owners, and external assessors.

What you'll need:

• BS degree in Computer Information Systems or related field

• 7+ years of experience with security GRC initiatives Experience with regulatory cybersecurity compliance examinations

• Substantive and current knowledge of transaction banking compliance, consumer and commercial lending, deposit, wires, cards and privacy regulations applicable to banks

• Experience with onboarding and monitoring cybersecurity controls in cloud environments specifically AWS

• Experience with AI governance and risk assessments using frameworks like NIST AI RMF, ISO42001, ISO 38507 and other privacy regulations like CCPA, GDPR etc

• Strong knowledge of security risk management and running audits/certification programs

• Self-starter with strong interpersonal and communication skills

• Demonstrate ability to assimilate new knowledge quickly

• Comfortable working in a fast-paced, dynamic environment, and managing multiple projects concurrently

• Experience with managing programs in GRC tools

Preferred qualifications:

• Banking/Fintech, Big 4, or management/IT consulting experience

• Strong risk management and governance experience KRI’s/KPI’s reporting

• Familiarity with CSPM, AWS security, CI/CD, SAST/DAST, SIEM and vulnerability

• management tools

• Strong JIRA and workflow management and agile project management experience

• Direct experience with regulatory cybersecurity compliance examinations

• Relevant certification (e.g. CISA, CISSP, PCI QSA, AWS certifications) or equivalent expertise

• Have risk assessment expertise with PCI DSS 4.0.1, SOX, NIST 800-53/800-37, NIST CSF, SOC 2, PCI, NYDFS NYCRR PART 500 and/or ISO 27001 standards, integrated controls framework, and evaluating design and effectiveness of IT controls working directly with auditors, regulators, investors

• Experience in building successful compliance programs for banks or fintech

• Experience defining compliance roadmaps based on customer requirements,

• compliance documentation, and ensuring that committed assessments are delivered on schedule

• Technical fluency; comfortable understanding and discussing technology concepts, experience evaluating tradeoffs and new opportunities with technical team members

Overview

About the Role

 The InfoSec Ops Senior Associate will sit on Instacart’s InfoSec Ops team and report to the Trust & Safety manager over InfoSec Ops. You will collaborate cross-functionally with GRC, Security, Procurement, Legal, Engineering, and other stakeholders in this role. You must be able to operate independently and with a high degree of confidentiality. 

About the Team 

Instacart's Trust & Safety department takes data-driven, customer-first approaches to ensure we are compliant with all local, state, and federal regulations regarding grocery fulfillment. The InfoSec Ops team focuses on keeping Instacart’s data (and the systems it flows through) safe at scale, from vendor risk management to internal access controls and beyond.

About the Job 

• The InfoSec Ops Senior Associate will handle a variety of operational and program management tasks related to data privacy and information security. You will be responsible for handling cadenced tasks (e.g., daily/weekly), high-priority escalations, and some program management responsibilities. You will also take ownership of privacy and security readiness efforts for high-visibility launches. You will be expected to manage competing priorities across several different subject matter areas. 
• Your operational responsibilities will include:
  • Evaluating vendors’ data collection practices and security postures; working with internal teams and vendor teams to understand the types of data each vendor would collect;  communicating Instacart’s security and privacy requirements
  • Tracking and reporting metrics on InfoSec Ops initiatives
  • Assisting with large-scale audit readiness efforts
  • Organizing, coordinating, and tracking cross-functional privacy and security projects involving multiple stakeholder teams
  • Acting as the DRI representing Trust & Safety’s privacy and security operations teams in high-visibility company-wide initiatives, including expansions into new markets and product surfaces
• Your program management responsibilities will include: 
  • Building and maintaining workflow documentation
  • Automating and monitoring recurring tasks using AI agents
  • Proactively coming up with ideas to improve operational efficiency
  • Identifying, tracking, and reporting success metrics
• We are looking for candidates with stellar written communication skills, business acumen, and a keen sense of situational awareness. You will need to navigate delicate situations with discretion and tact; as you develop in this role, you will be expected to understand when to under-communicate or over-communicate depending on the audience and situation.
• As a member of a small operational team supporting a program with company-wide impact, will take on project work to help the program continue to mature. You will surface ideas for projects and process improvements and drive them to fruition. You will be asked to take on data analysis tasks and metrics reporting.

About You

Minimum Qualifications

• 4+ years of experience within a Trust & Safety, risk, legal, or policy operations function, ideally one subject to legal, regulatory, or contractual obligations around sensitive data; 2+ years taking on elevated responsibilities within such an environment
• Demonstrated ability to navigate ambiguity and show leadership on complex, high-visibility operational workflows
• Track record of driving cross-functional projects to completion
• Familiarity with information security and data privacy concepts and vocabulary
• Stellar written and verbal communication skills, including the ability to convey complex privacy and security issues clearly to internal and external stakeholders
• Composure and precision when operating in time-sensitive or business-critical situations
• Working understanding of business metrics and reporting

Preferred Qualifications

• Professional experience related to information security and data privacy operations, esp. vendor risk management operations
• Familiarity with third party risk management frameworks
• CIPP/CIPM or SEC+ certification is a big plus

#LI-Remote

Overview

About the Role

 The InfoSec Ops Senior Associate will sit on Instacart’s InfoSec Ops team and report to the Trust & Safety manager over InfoSec Ops. You will collaborate cross-functionally with GRC, Security, Procurement, Legal, Engineering, and other stakeholders in this role. You must be able to operate independently and with a high degree of confidentiality. 

About the Team 

Instacart's Trust & Safety department takes data-driven, customer-first approaches to ensure we are compliant with all local, state, and federal regulations regarding grocery fulfillment. The InfoSec Ops team focuses on keeping Instacart’s data (and the systems it flows through) safe at scale, from vendor risk management to internal access controls and beyond.

About the Job 

• The InfoSec Ops Senior Associate will handle a variety of operational and program management tasks related to data privacy and information security. You will be responsible for handling cadenced tasks (e.g., daily/weekly), high-priority escalations, and some program management responsibilities. You will also take ownership of privacy and security readiness efforts for high-visibility launches. You will be expected to manage competing priorities across several different subject matter areas. 
• Your operational responsibilities will include:
  • Evaluating vendors’ data collection practices and security postures; working with internal teams and vendor teams to understand the types of data each vendor would collect;  communicating Instacart’s security and privacy requirements
  • Tracking and reporting metrics on InfoSec Ops initiatives
  • Assisting with large-scale audit readiness efforts
  • Organizing, coordinating, and tracking cross-functional privacy and security projects involving multiple stakeholder teams
  • Acting as the DRI representing Trust & Safety’s privacy and security operations teams in high-visibility company-wide initiatives, including expansions into new markets and product surfaces
• Your program management responsibilities will include: 
  • Building and maintaining workflow documentation
  • Automating and monitoring recurring tasks using AI agents
  • Proactively coming up with ideas to improve operational efficiency
  • Identifying, tracking, and reporting success metrics
• We are looking for candidates with stellar written communication skills, business acumen, and a keen sense of situational awareness. You will need to navigate delicate situations with discretion and tact; as you develop in this role, you will be expected to understand when to under-communicate or over-communicate depending on the audience and situation.
• As a member of a small operational team supporting a program with company-wide impact, will take on project work to help the program continue to mature. You will surface ideas for projects and process improvements and drive them to fruition. You will be asked to take on data analysis tasks and metrics reporting.

About You

Minimum Qualifications

• 4+ years of experience within a Trust & Safety, risk, legal, or policy operations function, ideally one subject to legal, regulatory, or contractual obligations around sensitive data; 2+ years taking on elevated responsibilities within such an environment
• Demonstrated ability to navigate ambiguity and show leadership on complex, high-visibility operational workflows
• Track record of driving cross-functional projects to completion
• Familiarity with information security and data privacy concepts and vocabulary
• Stellar written and verbal communication skills, including the ability to convey complex privacy and security issues clearly to internal and external stakeholders
• Composure and precision when operating in time-sensitive or business-critical situations
• Working understanding of business metrics and reporting

Preferred Qualifications

• Professional experience related to information security and data privacy operations, esp. vendor risk management operations
• Familiarity with third party risk management frameworks
• CIPP/CIPM or SEC+ certification is a big plus

#LI-Remote

Role Overview

ID.me is seeking a Technical Program Manager – Security Assurance to serve as the operational backbone of our external compliance programs. You will co-own the end-to-end lifecycle of controls, policies, and program-specific documentation for FedRAMP, ISO 27001, and SOC 2, with additional contributions to Kantara accreditation.

You will drive cross-functional alignment independently, owning outcomes rather than tasks. A unique requirement of this role is high proficiency with AI tools; our team utilizes purpose-built AI agents for evidence validation, control evaluation, and finding management. Fluency in AI-assisted workflows is essential.

This role is based out of our Mountain View, CA or McLean, VA offices and requires full-time in-office attendance.

Core Responsibilities

• 3+ years of experience operating security or compliance programs aligned to FedRAMP or NIST 800-53.
• 2+ years leading internal or external audits end-to-end, either as audit manager, program owner, or auditor.
• Experience managing control lifecycles, POA&M remediation, and continuous monitoring in a cloud-native environment (AWS or GCP).
• Hands-on experience with a GRC platform (LogicGate preferred) for control tracking, evidence management, and findings remediation.
• Demonstrated professional use of AI tools to support drafting, analysis, evaluation, or workflow automation within compliance or technical programs.

Preferred Qualifications

• Experience managing FedRAMP Continuous Monitoring and Significant Change Requests.
• Familiarity with NIST SP 800-63, digital identity systems, or Kantara accreditation.
• Certifications such as CISSP, CISA, CCSK, or ISO 27001 Lead Auditor.
• Experience in SaaS, FinTech, GovCloud, or other regulated technology environments.

#LI-JS1