Fractional CISO

Role overview

Provide part-time security leadership for a distributed software services organization, setting its governance direction and turning security standards into practical operating practices. The engagement is remote and expected to take 20–30 hours per week, with work spanning security planning, privacy compliance, client assurance, and incident readiness.

Responsibilities

- Build procedures and policies that address SOC 2 Type II and ISO 27001 controls. - Create a 12-month security roadmap and maintain a risk register that ranks remediation by business impact. - Guide data handling practices across European, Philippine, and Australian privacy requirements. - Develop consistent responses to client security questionnaires and support security audits and vendor assessments. - Put practical incident response, access control, and business continuity/disaster recovery policies in place. - Evaluate and oversee implementation of essential security tools, such as endpoint detection, SIEM, and vulnerability scanning.

Requirements

- Track record leading security governance in organizations of roughly 200–500 employees, including SOC 2 Type II or ISO 27001 certification work. - Strong understanding of secure software development and delivery, including SDLC and CI/CD security. - Familiarity with cloud platforms and workplace tools such as AWS and Google Workspace. - Ability to explain security topics and mentor both technical colleagues and non-technical stakeholders. - Experience managing client security audits and vendor assessments.

Nice to have

- Background in software services or outsourcing, experience with distributed teams across Europe, Asia, and Australia, or work with early-stage startups. - CISSP, CISM, or CISA certification.