> Markdown version of [/jobs/ext/4395841-chief-information-security-officer](https://www.wearedevelopers.com/jobs/ext/4395841-chief-information-security-officer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Chief Information Security Officer

- **Company:** Atlas Hotel, LP
- **Location:** San Francisco, CA, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Cyber Security, Data Retention, Anti-Phishing, Security Information and Event Management, Backup and Restore, Data Logging, Okta, Gsuite, Virtual Agents
- **Published:** October 12, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=42e4061ab4b9f913

## About the Role

* 10+ years in security, with 3+ leading a program at a B2B SaaS company.
 * Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.
 * Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.
 * Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.
 * Working knowledge of GDPR, DPAs and contract security terms.
 * Has led real incident response, including customer communication.
 * Fintech, ERP or accounting software background a strong plus.
 * Pragmatic builder: starts as a team of one, hires as we grow.

## Description

* Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.
 * Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.
 * Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.

Compliance and audits

 * Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.
 * Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.
 * Run Vanta as the system of record for controls and evidence.

Privacy and contracts

 * Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.
 * Review security and audit-cooperation clauses in customer contracts.
 * Own data retention, export and residency answers, including new-region or GovCloud requests.

Security operations and incident response

 * Own the incident response plan, run tabletop tests, and lead response when incidents happen.
 * Own customer breach notification decisions and post-incident write-ups.
 * Own detection and email security: SIEM, EDR, email protection, identity alerting.

Identity and access

 * Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production.
 * Support customer-facing SSO/SCIM setups.

Resilience and policy

 * Own BCDR plans, RTO/RPO targets, backup and restore testing.
 * Maintain information security, responsible AI and vendor management policies.
 * Run background and sanctions screening for employees and vendors.

AI security

 * Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out.
 * Govern AI vendors and subprocessors.

First 90 days

 * Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales.
 * Finish the Vanta migration and publish a trust center with standard collateral.
 * Finalize and test the BCDR and incident response plans.
 * Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage.
 * Present a 12-month security and certification roadmap to the CTO.