Information Security & Compliance Manager

You will run Cimetrics’ security and compliance program day to day, working with IT, Analytika engineering, and outside assessors, auditors and testers.

Defense cybersecurity compliance

• Own our NIST SP 800-171 compliance program, including the System Security Plan, Plan of Action and Milestones, and DoD assessment scoring.

• Manage DFARS cybersecurity obligations, including incident reporting and flow-down of requirements to subcontractors and vendors.

• Maintain scope and boundary documentation for systems that handle controlled information.

• Ensure compliance with federal contract cybersecurity and supply-chain clauses, including prohibited technology requirements.

Incident response

• Own the incident response plan and run regular tabletop exercises, including government reporting requirements.

SOC 2 for Analytika

• Lead our SOC 2 program from Type I through Type II, including scoping, auditor selection, readiness, evidence management and the audit cycle.

• Oversee physical and environmental controls for company-operated infrastructure, in partnership with IT.

Penetration testing program

• Plan and schedule third-party penetration tests, select vendors and set rules of engagement.

• Triage findings, drive remediation with IT and engineering, arrange retests, and produce customer-ready summaries.

Product vulnerability response

• Monitor vulnerability announcements affecting our products and their third-party components, and coordinate impact assessment, fixes and customer advisories with engineering.

• Own our coordinated vulnerability disclosure process and regulatory reporting, including EU Cyber Resilience Act reporting of actively exploited vulnerabilities, which starts with an early warning within 24 hours.

• Maintain software bills of materials (SBOMs) so we can quickly determine our exposure to newly announced vulnerabilities.

Customer and vendor security

• Lead responses to customer security questionnaires and contract security reviews, and build a reusable answer library.

• Assess vendors that handle our data and manage outside consultants, auditors and service providers.

Governance and product support

• Maintain security policies, risk assessments, training and compliance metrics.

• Advise the CTO or VP of Engineering on CRA and IEC 62443 security evidence and track resulting actions.

First-year objectives

By the end of the first year, our compliance program has clear ownership, penetration testing is a repeatable annual program, and the SOC 2 Type II observation period for Analytika is underway.

Within 90 days

• Take ownership of the NIST 800-171 compliance program and its documentation.

• Build working relationships with IT, Analytika engineering and our outside partners.

• Catalog the security and penetration testing requirements our customers impose.

• Take ownership of our process for responding to product vulnerability announcements.

Within 6 months

• Complete a penetration testing cycle with tracked remediation.

• Run an incident response tabletop exercise.

• Complete or schedule a SOC 2 Type I report for Analytika, with the auditor engaged for Type II.

Within 12 months

• Have the SOC 2 Type II observation period underway, with the report due early in the second year.

• Establish a reusable customer security answer library.

• Present a two-year compliance roadmap with budget and staffing needs.

We are looking for a hands-on security and compliance practitioner who has implemented and assessed controls, not only documented them.

• 5 or more years in information security or compliance, with a bachelor’s degree in computer science, information systems or engineering, or equivalent experience. Relevant military experience counts toward this requirement.

• Hands-on experience implementing and assessing security controls against a recognized framework, such as SOC 2, ISO 27001, NIST CSF, or NIST SP 800-53 or 800-171.

• AWS cloud security experience covering identity and access management, logging, encryption and configuration management.

• Experience managing third-party penetration tests and driving findings to remediation.

• Direct participation in at least one SOC 2 audit cycle.

• Experience building or running an incident response program.

• Clear writing and the ability to explain risk to engineers, executives, auditors and customers.

• Applicants must be authorized to work in the United States. Employment is contingent on background screening and on any authorizations required for access to controlled information.

Preferred qualifications

These strengthen an application but are not required.

• CISSP, or a commitment to earn it within 18 months of starting.

• Hands-on experience with NIST SP 800-171 Rev 2 (SSPs, POA&Ms and DoD assessment scoring) and DFARS 252.204-7012, 7019 and 7020, or a willingness to build this expertise with company-supported training.

• A CMMC Certified Professional or Registered Practitioner credential.

• End-to-end ownership of a SOC 2 audit, ideally for a SaaS service.

• Experience defining and documenting scope boundaries for systems that handle controlled information.

• Experience with hybrid or self-hosted infrastructure, including physical and environmental controls.

• Familiarity with OT, IoT or building automation security, IEC 62443, or the EU Cyber Resilience Act.

• Experience with product vulnerability response (PSIRT), coordinated vulnerability disclosure, or SBOM management.

• Familiarity with export control regulations (EAR and ITAR).

• ISO 27001 experience.

• Experience with a compliance automation platform.

Compensation and benefits

Compensation is competitive and based on experience.

• Benefits: health and dental insurance, a 401(k) plan, and other standard company benefits

• Work arrangement: hybrid, on site in Greenville, NH as the work requires

• Start date: as soon as possible

Cimetrics is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion or creed, sex, sexual orientation, gender identity, national origin, age, marital status, disability, genetic information, protected veteran status, or any other characteristic protected by law.

Cimetrics participates in E-Verify.

Pay: $94,800.00 - $140,000.00 per year, * 401(k)

• Dental insurance
• Flexible schedule
• Health insurance
• Vision insurance

Cimetrics is hiring its first dedicated Information Security & Compliance Manager to own our security compliance program, including U.S. defense cybersecurity requirements, SOC 2 for our Analytika service, and third-party penetration testing.

Cimetrics builds BACnet-based building automation software and hardware and operates Analytika, a hosted analytics service. Our work includes U.S. Department of Defense projects, and our enterprise customers expect strong, independently verified security practices.

This role reports to the CIO and is hybrid, based at our Greenville, NH facility. You will be on site whenever the work requires it, so you should live within commuting distance of Greenville or be willing to relocate. You will also advise our product teams on EU Cyber Resilience Act (CRA) and IEC 62443 security requirements; the CTO or VP of Engineering makes the final decisions on product compliance.