Manager Security and Compliance

MDMS Recruiting - Englewood, CO

Full-time - Manager

Englewood, CO

Administrative and Support Services

About the position

The Manager of Security and Compliance will oversee security and compliance for a SaaS product within the business unit. This role involves developing a multi-year roadmap and managing its execution, while also engaging with stakeholders to gain support for various initiatives. The position requires a hands-on approach and experience in leading security efforts, particularly in a business unit or division of a larger enterprise.

Responsibilities

• Oversee Security and Compliance for the business unit for a SaaS product.
• Develop a multi-year roadmap and manage execution against it.
• Engage stakeholders to gain support for security and compliance initiatives.
• Develop and maintain strategy for SOC 2 Type 2 and PCI-DSS attestations.
• Work with audit support contractors to plan and execute audits.
• Lead product security efforts and develop product security/SDLC strategy including SAST, DAST, and OSS scanning.
• Lead vulnerability management program and evaluate vulnerabilities in a Linux environment.
• Lead Incident Response process in collaboration with the NOC team.
• Lead Third-Party Risk Management program and vendor assessments for SOC 2 and PCI.
• Engage customer security teams and respond to RFPs.

Requirements

• Experience leading security for a business unit or division as part of a larger enterprise.
• Understanding of business risk appetite and tolerance.
• Experience with PCI-DSS as a Service Provider.
• Experience with SOC 2 Type 2 audits.
• Experience with GDPR, CCPA/CPRA.
• Experience with SAST, DAST, and OSS scanning.
• Experience with container security management.
• Experience with industry-standard vulnerability tools.
• Experience in evaluating vulnerabilities in a Linux environment.
• Experience with Qualys suite.
• Experience with Splunk and CrowdStrike.

Nice-to-haves

• Travel industry experience.
• SaaS experience.
• Experience with PCI-DSS 4.
• Experience leading privacy for a multinational SaaS product.
• Experience with Fortify On-Demand and Nexus IQ.
• Experience with SDLC for security and integration with CI/CD pipelines.
• Experience with structuring Incident Response process.
• Experience with Responsive.
• Experience creating customer white papers.

Benefits

• Hybrid or remote work options.
• Potential for right to hire after 6 months.