Chief Information Security Officer
Campfire · San Francisco
About this role
## About Campfire Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an **AI-native platform** that helps finance teams move faster and operate more efficiently. Campfire is hiring its **first full-time Chief Information Security Officer (CISO)** to own security, compliance, and customer trust as we sell to larger enterprises. - AI-native ERP and financial automation platform - Raised **$65M Series B** led by Accel and Ribbit Capital - Customers trust us with their general ledger, bank details, payroll, and vendor data - Today, security is run by a fractional vCISO firm plus a few engineers; deals are increasingly gated on security reviews --- ## What You’ll Own ### Customer security reviews & deal support - Answer security questionnaires, **TPRMs**, and **RFPs** (SIG, CAIQ, custom) with a fast, predictable turnaround - Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs - Maintain a **trust center** and **security collateral pack** (policies, pentest reports, network architecture, insurance certificate) ### Compliance & audits - Own **SOC 1** and **SOC 2** (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions - Decide and lead the path to **ISO 27001**, **ISO 42001**, and other frameworks customers ask about - Run **Vanta** as the system of record for controls and evidence ### Privacy & contracts - Partner with Legal on **DPAs**, **BAAs**, **GDPR transfer mechanisms** (SCCs/DPF), **DORA**, and non-US privacy laws - Review security and audit-cooperation clauses in customer contracts - Own data retention, export, and residency answers, including new-region or GovCloud requests ### Security operations & incident response - Own the incident response plan, run tabletop tests, and lead response when incidents happen - Own customer breach notification decisions and post-incident write-ups - Own detection and email security: **SIEM, EDR, email protection, identity alerting** ### Identity & access - Own **Okta** (SSO, phishing-resistant MFA, SCIM), **MDM**, and least-privilege access to production - Support customer-facing SSO/SCIM setups ### Resilience & policy - Own **BCDR** plans, **RTO/RPO** targets, and backup/restore testing - Maintain information security, responsible AI, and vendor management policies - Run background and sanctions screening for employees and vendors ### AI security - Answer customer questions on our AI assistant: underlying models, prompt/response retention, logging, and opt-out - Govern AI vendors and subprocessors --- ## First 90 Days 1. Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales 2. Finish the Vanta migration and publish a trust center with standard collateral 3. Finalize and test the BCDR and incident response plans 4. Close out post-incident hardening: email security, Okta alerting, MDM, and EDR coverage 5. Present a 12-month security and certification roadmap to the CTO --- ## What We’re Looking For - **10+ years** in security, with **3+** leading a program at a **B2B SaaS** company - Owned **SOC 1 / SOC 2** audits end to end (ISO 27001 experience is a plus) - Comfortable on calls with enterprise CIOs and auditors; enjoys helping close deals - Hands-on with **AWS**, **Okta**, **Google Workspace**, **EDR**, and
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.