Security & Compliance Lead

• Keep Archlet secure and audit-ready. Own our ISO 27001 compliance program, maintain policies and evidence in Vanta, coordinate internal and external audits, and ensure control owners complete their responsibilities and corrective actions.
• Lead our first SOC 2 Type II program in 2027. Build and execute the plan, select and manage the auditor, extend our existing controls and Vanta setup, and coordinate evidence collection through the examination period and final report. Own the recurring program afterward.
• Help customers confidently choose Archlet. Be the first point of contact for security and compliance questions across the company. Complete customer assessments, explain our safeguards clearly, and maintain our Trust Center and reusable answers to make future requests faster.
• Turn security, privacy, and AI risks into action. Maintain our risk registers, assess vendors, and keep subprocessor information current. Drive operational GDPR compliance and maintain documents such as DPAs, privacy assessments, and AI governance records, involving legal specialists when needed.
• Lead penetration testing and security remediation. Coordinate our annual independent pentest from scope and preparation through findings review, engineering tickets, retesting, and customer-facing reports. Work with engineering to prioritize findings and confirm that remediation addresses the underlying risk.
• Improve security across our product and workplace. Partner with Platform and Application Engineering on cloud security, identity, secure development, and security validation of new features. Run access reviews, manage security-tool findings and routine security configurations, and coordinate recovery tests and incident-response preparation.
• Make secure working easier and more efficient. Deliver practical employee and engineering training, run phishing exercises, and improve how we work through automation and thoughtful use of AI—for example, accelerating questionnaires, collecting evidence, and supporting security reviews.

• Experience owning delivery. Typically 5+ years in information security, security compliance, or GRC, with substantial responsibility in a SaaS or cloud-based software environment. You have personally operated programs and closed gaps, with results beyond recommendations and audit reports.
• Strong ISO 27001 and proven SOC 2 experience. You have independently managed an ISO 27001 audit cycle and held substantial delivery responsibility for a completed SOC 2 Type II cycle. You understand control design, operating evidence, auditor expectations, and remediation. Leading a first-time SOC 2 program is particularly valuable.
• Technical depth to work effectively with engineers. You understand cloud architecture, authentication and authorization, least privilege, endpoint protection, logging, and common application vulnerabilities. You can assess findings, challenge proposed solutions constructively, and agree on evidence that demonstrates a fix. Writing application code or opening PRs is not required.
• Practical privacy and risk-management skills. You have handled vendor assessments, risk registers, and operational GDPR requirements, including data processing agreements, retention, and international transfers. You can resolve routine questions independently and recognize when specialist legal advice is needed.
• Clear communication with customers and colleagues. You have completed enterprise security questionnaires and can explain technical safeguards accurately in excellent written and spoken English. You distinguish existing capabilities from planned improvements and avoid making unsupported commitments.
• Reliable execution across teams. You organize competing requests, manage external providers, follow up with contributors, and drive work through to completion. You make sensible tradeoffs and escalate material risks or capacity conflicts early.
• An adaptable, practical approach. You enjoy both detailed recurring work and new security challenges. You are comfortable switching from a lengthy questionnaire to audit preparation or an engineering discussion, and you actively improve processes that create unnecessary work.
• Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance is valuable. ISO 42001 experience is a bonus for potential future work.

We have a strong, international team of people with experience both in large enterprises like Google and Microsoft, but also experience in founding and growing tech startups. We push each other to higher degrees of product and engineering excellence, while looking at everything we do with a business mindset.
You'll have the autonomy to drive design decisions and make a real impact, with little bureaucracy and meetings, all within a supportive and innovative environment. We foster a culture of creativity and collaboration, with regular team activities, both virtual and in person.
Archlet is on a healthy growth trajectory, already has renowned customers like Walmart and PepsiCo, and has an exciting product roadmap that needs you to succeed.