Senior Manager of Information Security

Leads and matures the information security program at Plume, which already holds ISO 27001 and SOC 2 Type 1 certifications and now needs a hands-on leader to turn that base into a well-run, lasting program. The senior manager builds and leads the security team and is the main security voice to Engineering, Product, IT, Legal and executive leadership.

On governance, the role owns alignment with ISO 27001 and SOC 2, including the move to SOC 2 Type 2, writes and maintains the policies and standards needed to stay certifiable, runs risk assessments, control testing and evidence collection, and manages auditors, penetration testers and compliance partners. On engineering and operations, it owns the security of infrastructure, networks, AWS and GCP environments and applications, setting the roadmap for identity and access, cloud and network architecture, endpoint protection, vulnerability management, logging and incident response, and building secure SDLC practice such as threat modelling, code review and supply chain security. The role also writes and tests the incident response plan, briefs leadership and the board on risk, and supports customer questionnaires and audits. Early success means working policies, clear team ownership, an on-track SOC 2 Type 2 audit and little friction for engineers.

Plume wants six to eight or more years in information security, at least three of them leading a program end to end, day-to-day experience operating under ISO 27001 and SOC 2, and strong cloud, network and application security depth. Visa sponsorship is not available.