Information Security Lead
Acquisition · Remote, USA
About this role
## Information Security Lead ### Role The Information Security Lead makes security an operating discipline across ACQ—owning information security operations, incident readiness, risk, and the ongoing operation of **ISO 27001** and **ISO 42001**. This is a hands-on, founding role with deep ownership in **GRC** and **security operations**. You will build repeatable operating systems, lead investigations, and provide an independent view of risk. You’ll also bring technical depth to review application and infrastructure code, understand attack paths, and partner with engineering owners on practical code remediation. You will report to the **IT Systems Manager**, partner daily with **platform, application, and AI engineering**, collaborate with **Legal** on privacy, and work with the **CTO** as an executive sponsor of the function. --- ### Responsibilities - **Operate ISO 27001 & ISO 42001** via continuous evidence collection, risk management, control testing, internal audits, management reviews, corrective actions, and surveillance audit preparation. - **Build and run Security Operations**: centralized logging, detection engineering, alert triage, incident response, security investigations, insider-risk escalation, tabletop exercises, and post-incident improvements. - **Own the information security operating model**: policies, standards, risk acceptance, vulnerability governance, quarterly leadership reporting, security awareness, and the roadmap for maturing the function. - **Lead identity, access, vendor, and data-protection controls** including privileged-access governance, quarterly reviews, third-party assessment, classification, retention, deletion, and clear boundaries between operating companies. - **Provide independent technical assurance** across applications and cloud systems by reviewing architecture, application code, infrastructure-as-code, IAM policies, CI/CD workflows, and material vulnerabilities—working with engineers to remediate. - **Establish security & governance controls for AI systems**, including inventories, impact assessments, model/tool access, agent permissions, prompt-injection and data-exfiltration risks, audit trails, and tested shutdown mechanisms. --- ### Requirements - **7+ years** of information security experience, including experience operating **ISO 27001** programs. - **Active CISSP** (or eligibility and commitment to obtain within **6 months** of hire). - **ISO 42001** and **CGRC** experience preferred. - Experience remediating security incidents; practical experience building logging, monitoring, and detection capabilities. - Ability to read/write code (ideally **Python** and **JavaScript/TypeScript**) to identify attack paths, assess vulnerabilities, and recommend code-level fixes. - Proficiency with **infrastructure-as-code** (e.g., **Pulumi** or **Terraform**), **cloud IAM**, and deployment workflows. - Knowledge of **AI/agentic systems** and experience establishing practical security controls for their use. - Experience as a foundational or sole information security owner highly preferred. --- ### Results (What success looks like) - ISO 27001 & ISO 42001 run on a continuous cadence with current evidence, tested controls, reviewed risks, and corrective actions ready for surveillance audits. - Security signals are centralized and actionable; incident procedures are rehearsed; investigations have clear ownership; lessons produce verified control improvements. - Leadership receives a plain-
Listing freshness
CronJobs last confirmed this listing 3h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.