Your RoleRox agents read and act on our customers' most sensitive revenue data. Global 2000 security teams review us closely before they sign, and the trust we earn in those reviews is a core part of how we win and keep enterprise customers.
As an InfoSec Engineer (Risk and Compliance), you will own our compliance program as an engineer, not as a checklist keeper. You will run ISO 27001 and SOC 2, lead customer security due diligence, and manage vendor risk. You will also write the Python that collects evidence and monitors controls automatically, so audits stop eating the team's time.
This is a senior individual contributor role and the second hire on our security team. You will report to Mike Tan, our Head of Security, and work closely with Engineering and Infrastructure on controls and fixes, and with Legal and Finance on security addenda, data processing agreements, and vendor contracts. Within your first three months you will fully own four areas with little supervision.
Responsibilities- Compliance automation (30%): Build scripts and integrations in Python against REST APIs that collect evidence, monitor controls, and generate reports. Replace manual screenshots with compliance as code.
- Audit operations (30%): Own the ISO 27001 certification program, including audit findings, the Statement of Applicability, the risk register, and internal audit. Keep SOC 2 compliance continuous: fix failing tests, answer evidence and auditor requests, maintain policies, and run access reviews.
- Customer security due diligence (20%): Run the customer security review queue end to end, from questionnaires (CAIQ, SIG, and custom) to security addenda and due diligence calls with enterprise security teams.
- Vendor and risk management (20%): Assess vendors, review sub-processors, and keep the risk register current as Rox adds new tools and partners.
- Partner with Engineering and Infrastructure on the systems behind the evidence: AWS, the software development lifecycle, change management, and vulnerability fixes.
- Partner with Legal and Finance on data processing agreements, customer security addenda, and vendor procurement.
What success looks like- First 3 days: You have access to Secureframe, AWS, and GitHub, can explain our SOC 2 and ISO 27001 control set and where each framework stands, and have worked a live customer security questionnaire with our Head of Security.
- First 3 weeks: You run the customer security review queue end to end and have automated evidence collection for at least one recurring audit control.
- First 3 months: You fully own ISO 27001, continuous SOC 2 compliance, customer security due diligence, and vendor risk management, and you have shipped tooling that cuts recurring manual audit work.
Qualifications- 4+ years in GRC or security compliance, with hands-on experience running SOC 2 and ISO 27001 audits.
- You code. You write Python scripts and API integrations to automate evidence collection and control monitoring, and you are comfortable with SQL and Git.
- Working knowledge of AWS security services and logs, such as IAM, CloudTrail, KMS, and Config.
- Experience with a GRC platform such as Secureframe, Vanta, or Drata.
- Experience answering enterprise security questionnaires (CAIQ, SIG) and joining due diligence calls with customer security teams.
- Familiarity with GDPR and data processing agreement concepts.
- You own outcomes with little supervision and can explain risk clearly to engineers, executives, and customers.
- Be located in or willing to relocate to San Francisco. This role is onsite at our SF HQ five days a week.
Nice to haves- Led an ISO 27001 certification or a first SOC 2 Type II from scratch.
- Experience with JumpCloud, Datadog, or Semgrep.
- Experience managing third-party risk at a fast growing B2B SaaS or AI company.
Benefits- Competitive pay with considerable equity upside (base salary range: $180,000 to $220,000 USD)
- Medical, dental, and vision, including 100% company-paid plans for you and eligible dependents
- Company-paid life & AD&D, plus short- and long-term disability
- 401(k) with automatic enrollment
- Unlimited PTO, plus paid sick leave, company holidays, and bereavement
- Up to 20 weeks of paid parental leave at 100% pay (birth, adoption, or foster)
- Wellness stipend: $375/quarter
- Learning stipend: up to $2,000/year
- Internet & cell phone stipend: $25/month
- Mental health support, virtual care, and care navigation
- Fertility & family-building support, plus backup care membership
- Pre-tax commuter benefits (transit & parking)
- SF HQ: daily catered breakfast & lunch, meal allowances, and rideshare support when commuting to the office
ApplyTo apply, please fill out the application form. We're looking forward to connecting with you!
