Remote Information Security & Compliance Manager (GRC) – Mid-Level/Transition Opportunity

We are hiring an Information Security & Compliance Manager to lead SOC 2 Type II and PCI DSS 4.x compliance and own the security and compliance program end-to-end, keeping it audit-ready. The role runs in two directions. Internally, you own the program: policies and guidelines, access reviews, security-awareness training, vendor and risk reviews, the control-to-evidence mapping in Vanta, incident response, and the security questions that arrive from customers and prospects. Externally, you carry the same work into client engagements, supporting the companies we build software for through their own SOC 2 and PCI DSS programs — each with its own scope, auditor and deadlines. Throughout, you work alongside the engineers actually building these systems, which means your recommendations have to be implementable, not just defensible on paper.

What You'll Do

Drive SOC 2 Type II and PCI DSS 4.x readiness and continuous compliance — scoping, control design, evidence, auditor coordination, and remediation Own the security and compliance program: policies and guidelines, access reviews, security-awareness training, vendor and risk reviews Maintain the control-to-evidence mapping in the compliance tooling (Vanta) and keep policies and operational docs consistent Coordinate incident response and field security questions from customers and prospects Support client engagements through their own SOC 2 Type II and PCI DSS 4.x programs — each with its own scope, auditor and deadlines — working alongside the engineering teams actually building those systems, so remediation is implementable rather than theoretical What You Bring 4+ years in information security, GRC, or IT compliance, with hands-on SOC 2 (ideally Type II) and PCI DSS experience Working knowledge of common frameworks and cloud environments (GCP/AWS) Clear writing — audit-ready documentation and the ability to explain requirements to engineers and non-technical stakeholders U.S.-based. Certifications (CISSP, CISA, CISM) are a plus

Nice to Have

Payments or fintech background — most of what we build touches money movement Familiarity with PCI DSS 4.x future-dated requirements, which became mandatory in March 2025 Exposure to ISO 27001, HIPAA, GDPR or NIST Consulting or agency experience — you will be in front of clients and running more than one program at a time How We Work Fully remote, across 14 jurisdictions and five continents Small senior teams. This is a startup environment rather than a large enterprise one AI use is mandatory for our engineers, and we expect the same pragmatism from everyone else Direct communication, high autonomy, low process overhead Why Is This Great For Me? Fully remote Full premium benefits 401K match Unlimited PTO Your role and responsibilities will expand as the company grows Work remotely with the flexibility to set your own schedule and take vacations We respect work-life balance and don't require more than 40 hours per week unless you choose to Collaborate with driven and motivated colleagues Enjoy an open-minded culture that values opinions and feedback Minimal meetings, maximizing your productivity