> Markdown version of [/jobs/ext/4614982-information-security-compliance-manager](https://www.wearedevelopers.com/jobs/ext/4614982-information-security-compliance-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security & Compliance Manager - **Company:** Cimetrics Inc. - **Location:** Greenville, NH, United States - **Experience:** Expert - **Salary:** $94,800 - $140,000 - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Software System Penetration Testing, Software as a Service, Configuration Management, Cyber Security, Information Systems, Identity and Access Management, Data Logging, Information Security Management System, National Institute of Standards and Technology Cybersecurity Framework, Information Technology, Plan of Action and Milestones - **Published:** November 7, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=37a1d00045bcf56f ## About the Role We are looking for a hands-on security and compliance practitioner who has implemented and assessed controls, not only documented them. * 5 or more years in information security or compliance, with a bachelor's degree in computer science, information systems or engineering, or equivalent experience. Relevant military experience counts toward this requirement. * Hands-on experience implementing and assessing security controls against a recognized framework, such as SOC 2, ISO 27001, NIST CSF, or NIST SP 800-53 or 800-171. * AWS cloud security experience covering identity and access management, logging, encryption and configuration management. * Experience managing third-party penetration tests and driving findings to remediation. * Direct participation in at least one SOC 2 audit cycle. * Experience building or running an incident response program. * Clear writing and the ability to explain risk to engineers, executives, auditors and customers. * Applicants must be authorized to work in the United States. Employment is contingent on background screening and on any authorizations required for access to controlled information. Preferred qualifications These strengthen an application but are not required. * CISSP, or a commitment to earn it within 18 months of starting. * Hands-on experience with NIST SP 800-171 Rev 2 (SSPs, POA&Ms and DoD assessment scoring) and DFARS 252.204-7012, 7019 and 7020, or a willingness to build this expertise with company-supported training. * A CMMC Certified Professional or Registered Practitioner credential. * End-to-end ownership of a SOC 2 audit, ideally for a SaaS service. * Experience defining and documenting scope boundaries for systems that handle controlled information. * Experience with hybrid or self-hosted infrastructure, including physical and environmental controls. * Familiarity with OT, IoT or building automation security, IEC 62443, or the EU Cyber Resilience Act. * Experience with product vulnerability response (PSIRT), coordinated vulnerability disclosure, or SBOM management. * Familiarity with export control regulations (EAR and ITAR). * ISO 27001 experience. * Experience with a compliance automation platform. ## Description You will run Cimetrics' security and compliance program day to day, working with IT, Analytika engineering, and outside assessors, auditors and testers. Defense cybersecurity compliance * Own our NIST SP 800-171 compliance program, including the System Security Plan, Plan of Action and Milestones, and DoD assessment scoring. * Manage DFARS cybersecurity obligations, including incident reporting and flow-down of requirements to subcontractors and vendors. * Maintain scope and boundary documentation for systems that handle controlled information. * Ensure compliance with federal contract cybersecurity and supply-chain clauses, including prohibited technology requirements. Incident response * Own the incident response plan and run regular tabletop exercises, including government reporting requirements. SOC 2 for Analytika * Lead our SOC 2 program from Type I through Type II, including scoping, auditor selection, readiness, evidence management and the audit cycle. * Oversee physical and environmental controls for company-operated infrastructure, in partnership with IT. Penetration testing program * Plan and schedule third-party penetration tests, select vendors and set rules of engagement. * Triage findings, drive remediation with IT and engineering, arrange retests, and produce customer-ready summaries. Product vulnerability response * Monitor vulnerability announcements affecting our products and their third-party components, and coordinate impact assessment, fixes and customer advisories with engineering. * Own our coordinated vulnerability disclosure process and regulatory reporting, including EU Cyber Resilience Act reporting of actively exploited vulnerabilities, which starts with an early warning within 24 hours. * Maintain software bills of materials (SBOMs) so we can quickly determine our exposure to newly announced vulnerabilities. Customer and vendor security * Lead responses to customer security questionnaires and contract security reviews, and build a reusable answer library. * Assess vendors that handle our data and manage outside consultants, auditors and service providers. Governance and product support * Maintain security policies, risk assessments, training and compliance metrics. * Advise the CTO or VP of Engineering on CRA and IEC 62443 security evidence and track resulting actions. First-year objectives By the end of the first year, our compliance program has clear ownership, penetration testing is a repeatable annual program, and the SOC 2 Type II observation period for Analytika is underway. Within 90 days * Take ownership of the NIST 800-171 compliance program and its documentation. * Build working relationships with IT, Analytika engineering and our outside partners. * Catalog the security and penetration testing requirements our customers impose. * Take ownership of our process for responding to product vulnerability announcements. Within 6 months * Complete a penetration testing cycle with tracked remediation. * Run an incident response tabletop exercise. * Complete or schedule a SOC 2 Type I report for Analytika, with the auditor engaged for Type II. Within 12 months * Have the SOC 2 Type II observation period underway, with the report due early in the second year. * Establish a reusable customer security answer library. * Present a two-year compliance roadmap with budget and staffing needs.