5-7 years of experience in security compliance, particularly in cloud or SaaS environments.
Strong technical understanding of access, infrastructure, and development controls.
Ability to prioritize security gaps based on risk and operational context.
Proven skill in evaluating evidence quality to support compliance claims.
Experience connecting policy requirements to operational controls and effectively communicating results.
Responsibilities
Own and maintain the Assurance Program, ensuring policies and controls meet audit frameworks.
Coordinate audit readiness activities, including evidence collection and control testing.
Manage security diligence workflows, verifying responses with technical and legal teams.
Oversee governance tasks such as access reviews and vendor risk assessments.
Maintain an actionable risk register and report on control gaps and commitments.
Benefits
Health & Dental Insurance
Monthly Wellness Stipend
401K Matching
Full Job Description
About the Role
Location: New York City Commitment: 5 Days In-Person
We're looking for someone who can connect security requirements to controls that work in practice and stand up to customer scrutiny.
As a Security and Compliance Manager at Endex, you'll own our security assurance and compliance program: controls, audit readiness, customer diligence and remediation tracking. You'll coordinate the people and evidence needed to meet commitments, working with Security Engineers on technical controls and counsel on legal interpretation. Your Key Responsibilities
Own the Assurance Program: Maintain policies, controls and evidence for the audit frameworks and customer commitments Endex chooses to support.
Run Audit Readiness: Coordinate evidence collection, control testing, risk assessments and remediation with clear owners and deadlines.
Support Customer Trust: Own security diligence and questionnaire workflows, verifying answers with technical and legal owners.
Build Practical Governance: Coordinate access reviews, training, vendor risk and incident-readiness work, including AI-related risks where relevant.
Track Risk and Follow-Through: Maintain an actionable risk register and report progress on control gaps and security commitments.
What We're Looking For
Security Compliance Experience: You've assessed controls in a cloud or SaaS environment.
Technical Understanding: You can discuss access, infrastructure and development controls with engineers.
Practical Judgment: You prioritize gaps based on risk and operational context.
Evidence Quality: You can evaluate whether a record supports the claim being made.
Assurance Experience: You can connect a policy requirement to an operating control, test the evidence and explain the result accurately to customers or auditors.
Nice to Have
Experience with SOC 2 or ISO 27001 assessments
Experience with enterprise security questionnaires
Experience with SOC 2 or ISO 27001, control evidence automation and AI risk frameworks
