The Infosec and Compliance Engineer plays a pivotal role securing Solo’s infrastructure, data and software. This person is responsible for helping Solo.io define, establish and manage our corporate security strategy. This is a hands-on role helping Solo build and define the security compliance mechanisms for our products and services. It involves working with all departments at Solo.io to identify areas relevant to each department for compliance purposes, providing expert guidance. In addition, this person will help implement and document applicable policies and processes. The fractional CISO will work directly with auditors leading our security compliance. This resource may also work with our customers and prospects to understand security requirements, respond to security related inquiries and help Solo establish security commitments between both parties. The ideal candidate will have hands-on security compliance experience in a cloud native environment, as well as excellent customer facing and technical documentation skills.
Areas of Responsibility
Lead Audits & Security ComplianceLead Internal Cybersecurity Audits to ensure our operational environments stay compliant and secure.Respond to security questionnaires from our customers to help us grow our business and articulate Solo’s security compliance approach.Act as liaison between us and our customers.Perform quantitative Risk Assessments to help internal teams understand where to make smart investments in cybersecurityAuthor security policy documents to build up our security and cybersecurity programs.Assist with evidence collection to help us prepare for external compliance audits utilizing our compliance automation tool Vanta.Provide advice and guidance on a wide range of cybersecurity topics.Project manage security deliverables to keep us on track.Contribute to service development programs to improve our deliverables.Corporate Security StrategyHelp define and build security strategy company wide and for each department.Work with all internal departments to establish security standards and processes to comply with corporate security strategy.Provide expert guidance to departments and teams on ongoing security compliance requirements.Provide training as needed to practice how they will respond to a cybersecurity incident.Help establish and maintain Compliance ManagementHelp establish security compliance plan company wide, including but not limited to SOC2 and ISO27001 compliance.Work with auditors to provide compliance evidence as needed, while working with departments to establish said processes in order to complyResponsible for managing adherence to company information security and data privacy standards and frameworks including SOC 2 and any others deemed applicableAs needed, author compliance documentation and policies.Own maintaining compliance with relevant data privacy and information security laws and regulations (e.g. GDPR, CCPA).QualificationsThe ideal candidate will possess all of these traits:
- 3+ years of InfoSec and security compliance expertise with successful track record of obtaining SOC2 and ISO-27001 compliance
- 2+ years of SOC analyst or security compliance management experience in a cloud native environment
- 2+ years of Customer Service or other customer facing experience
- 2+ Years of Prior SW development or DevOps experience
- 2+ years of SaaS and Cloud technical hands on experience
- 2+ years working with agile methodologies
- Highly desirable: 2+ years of Kubernetes hands on experience
- A passion about solving clients’ security challenges
- Well-developed technical writing skills
In addition, highly qualified candidates will likely possess technical experience in one of these areas:
- Security Operations (SOC)
- Security Compliance (SOC 2, ISO 27001, PCI-DSS, HIPAA, etc.)
- Secure Software Development Lifecycle (S-SDLC) practices
- System Administration (Windows, Linux)
- Cloud Administration (AWS, Azure, Google Cloud)
- Network or firewall administration
And have one or more of these experiences:
- Knowledge of security operations tools, systems, and practices (SIEM, WAF, vulnerability scanning, penetration testing, system hardening, MFA, SSO, etc.)
- Familiar with core networking concepts, protocols, and common services
- Understanding of encryption concepts and SSL/TLS certificates
- General scripting or coding experience
- Cybersecurity certifications (SSCP, CompTIA Security+, etc.)
- Experience with any security frameworks (NIST CSF, CIS, COBIT, etc.)
- A degree in Cybersecurity or a related field.
Solo is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability.
