> Markdown version of [/jobs/ext/4569799-head-of-security-compliance](https://www.wearedevelopers.com/jobs/ext/4569799-head-of-security-compliance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Head of Security & Compliance - **Company:** RMG Networks Holding Corporation - **Location:** United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Software System Penetration Testing, Microsoft Azure, Software as a Service, Cloud Computing Security, Cyber Security, Identity and Access Management, Information Technology Audit, Systems Development Life Cycle, Anti-Phishing, Systems Integration, Software Vulnerability Management, Data Processing, Software Security, Information Technology - **Published:** November 4, 2026 - **Apply:** https://recruiting.paylocity.com/Recruiting/Jobs/Apply/4637083 ## About the Role * 6-10 years of hands-on security and compliance experience at a SaaS or technology company. * Direct, personal experience running a SOC 2 Type II audit cycle, including evidence collection and auditor management. You have done this work yourself, not just overseen it. * Experience owning customer security questionnaires, RFI/RFP security responses, and customer security reviews for enterprise buyers. * Working proficiency with a GRC platform such as Vanta, Drata, or Secureframe. * Strong working knowledge of cloud security (AWS and/or Azure), identity and access management, and vulnerability management. * Ability to write clear, audit-ready policies and procedures, and to explain security posture credibly to customers, auditors, and executives. * Experience coordinating incident response and working directly with engineering teams on remediation. * Comfort operating as a one-person security function: self-directed, organized, and accountable for outcomes without a team. * Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent practical experience. PREFERRED QUALIFICATIONS * Industry certifications such as CISSP, CISM, CCSP, CISA, or ISO 27001 Lead Implementer/Auditor. * Experience taking a company through ISO 27001 readiness or certification. * Experience at a PE-backed or high-growth SaaS company where security supported the sales process. * Familiarity with application security practices and secure SDLC. ## Description The Head of Security & Compliance owns Korbyt's security and compliance program from end to end. This includes our SOC 2 audit cycle, customer security questionnaires and RFI responses, internal information security policies and controls, vendor risk management, and the external partners we use for technical security work. This is a hands-on, execution-focused individual contributor role. You will personally run the compliance program, write the policies, collect the audit evidence, answer the questionnaires, and manage the auditors and vendors. While you'll have a cross-functional teams you can rely on for collaboration and information, you will be the primary person responsible for writing policies and gathering evidence. The right candidate gets energy from doing this work themselves and takes pride in being the person who gets security answers across the finish line. Security is a direct factor in winning and keeping enterprise customers. This role exists to make security a competitive advantage for Korbyt: fast, credible responses to customer security reviews, a clean SOC 2 report, and internal practices that hold up under scrutiny., * Own the SOC 2 Type II audit cycle end to end: control design and operation, evidence collection, auditor relationship, remediation, and annual renewal. * Run our GRC platform as the system of record for controls, policies, and evidence, keeping it audit-ready year-round rather than scrambling at renewal time. * Maintain and advance compliance posture against frameworks relevant to our customers, including readiness work toward additional certifications as business needs dictate (e.g., ISO 27001). * Track regulatory and privacy requirements that apply to our business (GDPR, CCPA) and keep policies and practices aligned. Customer Security Enablement * Own responses to customer security questionnaires, RFI/RFP security sections, audits, and due diligence requests, working directly with Sales and Sales Engineering. * Build and maintain a reusable library of approved security responses, documentation, and artifacts so customer reviews get faster over time. * Represent Korbyt on customer and prospect security review calls. * Identify security gaps that block enterprise deals and drive them to resolution with Engineering and IT. Internal Security Policies, Procedures & Controls * Write, maintain, and continuously improve Korbyt's information security policies, standards, and procedures. * Design and operate internal controls across access management, change management, vendor management, data handling, and employee lifecycle. * Run periodic access reviews, risk assessments, and internal audits, and maintain the risk register and remediation plans. * Report security and compliance posture to executive leadership with clear, practical metrics. Security Operations & Incident Response * Run vulnerability management: track findings from scans and penetration tests, prioritize, and drive remediation with Engineering and IT. * Coordinate incident response: maintain the IR plan, lead investigations when issues arise, and run post-incident reviews and customer communications as needed. * Partner with Engineering to embed security requirements into the development lifecycle and review security implications of new products, technologies, and integrations. * Maintain business continuity and disaster recovery documentation and testing from a security perspective. Vendor & Partner Management * Select and manage external security partners: penetration testing firms, auditors, and managed security or monitoring services where they make sense. * Run the third-party vendor risk program, including security reviews of new vendors and periodic reassessment of existing ones. Security Awareness & Training * Run the company security awareness program, including onboarding training, annual refreshers, and phishing simulations. * Promote practical security accountability across all business functions.