Associate Security Program Manager

Oneleet

5d•$35,000 - $65,000•Remote

About The Position

The Associate Security Program Manager has hybrid responsibility for internal security compliance auditing and security program management. Approximately half of the role focuses on an internal QA team reviewing client evidence and controls before clients work with external auditors. The other half is client-facing, supporting Security Program Managers as they help companies develop audit-ready security programs. The role combines evidence review with implementation support, with the goal of helping clients build security programs grounded in their actual environments and practices. The position involves reviewing evidence across multiple compliance frameworks, identifying and documenting gaps, and helping maintain QA methods and readiness guidance. It also includes participating in client consultations, supporting the creation and implementation of security programs, communicating security concepts to varied stakeholders, and coordinating with auditors. The role is intended to develop into a full Security Program Manager position. Oneleet is a remote-first security and compliance platform company that helps organizations build, manage, and monitor cybersecurity programs and achieve standards such as SOC 2 and ISO 27001. The company describes its culture as fast-moving, collaborative, impact-focused, and oriented toward autonomy and clear communication. It hires globally where legally possible.

Requirements

At least 3 years of experience in information security, compliance, or audit, such as GRC, IT or compliance auditing, security operations, security advisory, or security-adjacent customer success or IT support.
Working knowledge of SOC 2, ISO 27001, HIPAA, GDPR, and PCI, including how controls map to real infrastructure and operations.
Familiarity with cloud and infrastructure technologies such as AWS, Azure, GCP, Kubernetes, Docker, or Terraform, and ability to learn new technologies quickly.
Exposure to reviewing or preparing evidence for compliance audits.
Client-facing or stakeholder-facing experience, with strong organization and project-management instincts.
Excellent attention to detail and a quality-control mindset.
Clear written communication for documenting findings and confident verbal communication on client calls.
Comfort switching between focused review work and a high-volume, high-interruption client queue.
Self-driven, comfortable with ambiguity, and able to manage multiple client engagements in a fast-moving startup environment.

Nice To Haves

Progress toward or possession of a certification such as CISA, Security+, CISSP (Associate), CISM, or ISO 27001 Lead Auditor/Implementer.
Experience with compliance automation platforms.
Background in customer success, IT support, or technical support.
Startup experience, either as an employee or consultant.

Responsibilities

Review client-uploaded evidence for SOC 2, ISO 27001, PCI, HIPAA, and GDPR for completeness, accuracy, and sufficiency.
Perform QA checks on individual controls and support final pre-audit reviews before clients engage third-party auditors.
Identify gaps or weak evidence and document findings with clear, actionable fixes.
Help maintain internal QA standards and review methodologies, and contribute to guidance documents that help clients produce better evidence.
Track audit-readiness metrics and flag opportunities to improve processes.
Share feedback with product and engineering teams about ways the platform can better support audit readiness.
Join and help run consultation calls with new clients to understand their security posture, infrastructure stack, compliance requirements, and goals.
Support Security Program Managers in building technical, operational, and administrative control programs based on industry frameworks and each client’s environment.
Help clients implement programs through policies, procedures, configurations, and software integrations.
Serve as a responsive client point of contact and explain security concepts to technical and non-technical stakeholders.
Help coordinate with auditors so client programs meet auditor expectations.
Use lessons from QA reviews to help clients produce appropriate evidence the first time.