Information Security Contractor
Information Security Contractor Job Overview Role Type: 6-Month Contract (W-2 or 1099; option to extend through SOC 2 Type II observation window) Location: 100% Remote Target Pay Rate: $80 – $100 / hour (DOE) Reports To: Senior Director, IT Role Summary This is an internal execution role focused on operationalizing deployed security tooling, closing existing vulnerability findings, and driving internal SOC 2 Type I and Type II readiness to completion. The ideal candidate is a hands-on practitioner who can turn deployed platforms into working controls, manage an MSSP relationship, and build a repeatable evidence collection process.
Key Responsibilities
Lane 1: Security Operations & Tooling Ownership Tooling Operationalization: Serve as internal owner for platforms including Wiz (CSPM), Prisma Access (SASE, ~1,500 users), Proofpoint (Email), Clutch Security (Non-human identity/AI), and HackerOne (Bug Bounty). Define alert routing, runbooks, and tuning cadences. Vulnerability Lifecycle Management: Own intake, triage, tracking, and verification of security findings end-to-end; establish time-to-closure metrics. MSSP Management: Act as internal technical counterpart to the MSSP (Trace3 / Steel Patriot Partners), validating alert quality, challenging escalations, and mirroring security evidence. Documentation & Penetration Testing: Maintain production security architecture documentation and route continuous pen test findings through closure workflows. Lane 2: SOC 2 Readiness Execution SOC 2 Delivery: Drive execution toward the July 1, 2027 SOC 2 Type II target date and interim Type I report. Control Matrix & Evidence: Build/maintain control matrix mapping each control to owners, operating cadences, and repeatable evidence artifacts produced via normal operations. Policy & Audit Logistics: Author/revise required policies, run readiness checkpoints, and manage audit logistics (walkthroughs, sample pulls, evidence requests).
Qualifications
Required Experience: 6+ years in information security with direct experience operating security tools in production cloud/hybrid environments. SOC 2 Execution Track Record: Proven experience taking an organization through SOC 2 readiness to a completed Type II report in an execution capacity (not advisory). Technical Breadth: Hands-on fluency with CSPM, IAM, endpoint/email security, network segmentation, vulnerability management, and MSSP oversight. Communication: Ability to write technical documentation for remediation owners and clear status updates for executive leadership. Preferred Experience in consumer hardware, connected devices, or subscription platforms. Experience using Jira and Jira Service Management for findings and evidence tracking. Industry certifications: CISSP, CISA, CCSP, or equivalent.