Manager, IT Security

Role overview Lead hands-on IT security operations while managing one security engineer and improving security across cloud infrastructure, identity, endpoints, applications, and AI integrations. The role combines technical delivery, incident and audit ownership, and cross-functional partnership to reduce risk while supporting business needs.

Responsibilities - Strengthen AWS security, including identity and access management, account governance, networking, and monitoring; manage identity controls such as conditional access, single sign-on, provisioning, and privileged access. - Maintain endpoint protection, patching, detection coverage, and monitoring, and improve the use of security operations tools. - Run vulnerability management from discovery through remediation; lead incident response with a managed detection and response partner and drive follow-up actions. - Work with AI and engineering teams to protect AI tools and integrations through data safeguards, appropriate permissions, and controls for non-human identities. - Own SOC 2 Type II audit preparation and delivery, including evidence, remediation, and auditor coordination; maintain PCI DSS requirements and support vendor risk reviews. - Partner with engineering on secure development environments, CI/CD pipelines, source control, and application integrations; set a prioritized security roadmap and develop a security engineer.

Requirements - At least 7 years of information security experience, including leading security programs or initiatives and formally managing or leading security professionals. - Hands-on AWS security experience, including IAM, multi-account governance, network security, and services such as GuardDuty, Security Hub, and CloudTrail. - Deep experience with Microsoft Entra ID, conditional access, federation or SSO, privileged access, and identity lifecycle management. - Practical experience with endpoint security, vulnerability management, incident response, and MDR/SOC partners. - Proven ownership of SOC 2 Type II audits, from control implementation and evidence collection through auditor coordination and remediation. - Working knowledge of AI security risks and ability to communicate recommendations to technical and business audiences.

Nice to have - Experience with PCI DSS, NIST CSF, ISO 27001, or CIS Controls; relevant security or cloud certifications; scripting, automation, or infrastructure-as-code skills; or experience securing a distributed workforce.

Benefits and work setup - Primarily remote within the U.S., with work hours mainly aligned to Eastern Time and occasional office visits for collaboration, training, or company events. Eligible states are limited; the source lists Arizona, California, Colorado, Connecticut, Florida, Georgia, Illinois, Indiana, Kansas, Massachusetts, Maryland, Michigan, Missouri, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Virginia, and Wisconsin. - Benefits include medical, dental, and vision coverage, a 401(k) with company match, paid time off and holidays, wellness programs, and an employee assistance program.