Manager, Information Security

Runs information security compliance at Synack across ISO, SOC, CMMC and FedRAMP. The manager works with Product, Engineering and Operations to make sure the right security controls and monitoring are in place across Synack's hosted services and infrastructure, and pushes the function towards automation rather than manual paperwork.

Much of the work is building machinery. The role automates the production of System Security Plans and their supporting artefacts, keeps Plans of Action and Milestones generated automatically, conducts security impact analysis when major systems change, and builds automated evidence collection that flags when controls drift. Controls are encoded as IaC guardrails, CNAPP rules and pipeline checks so problems are caught at commit and deploy time. The manager also owns the inventory and risk assessment of AI and agentic systems used across the company against NIST AI RMF and ISO 42001, including how agents are changed, which credentials they hold and how they handle data. Responding to customer security questionnaires with the field teams, assessing Synack's own vendors, and reporting compliance status and remediation progress round out the job.

Synack wants eight or more years in security strategy, risk, IT audit and compliance at a cloud service provider, with hands-on Python, Terraform and pipeline skills, GRC platforms, monitoring tools such as Datadog or Sentinel, SOAR and SIEM query languages, CNAPP and non-human identity. Because of federal contract terms, only US citizens can be hired. The role is remote in the US.