Chief Information Security Officer

Campfire•San Francisco, CA

3d•Remote

About The Position

Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises. Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital. Customers trust us with their general ledger, bank details, payroll and vendor data. Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews. You will turn that into an in-house program that closes deals faster and keeps us safe.

Requirements

10+ years in security, with 3+ leading a program at a B2B SaaS company.
Has owned SOC 1 / SOC 2 audits end to end.
Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.
Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.
Working knowledge of GDPR, DPAs and contract security terms.
Has led real incident response, including customer communication.
Pragmatic builder: starts as a team of one, hires as we grow.

Nice To Haves

ISO 27001 experience a plus.
Fintech, ERP or accounting software background a strong plus.

Responsibilities

Own customer security reviews and deal support, including answering security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.
Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.
Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.
Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.
Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.
Run Vanta as the system of record for controls and evidence.
Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.
Review security and audit-cooperation clauses in customer contracts.
Own data retention, export and residency answers, including new-region or GovCloud requests.
Own the incident response plan, run tabletop tests, and lead response when incidents happen.
Own customer breach notification decisions and post-incident write-ups.
Own detection and email security: SIEM, EDR, email protection, identity alerting.
Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production.
Support customer-facing SSO/SCIM setups.
Own BCDR plans, RTO/RPO targets, backup and restore testing.
Maintain information security, responsible AI and vendor management policies.
Run background and sanctions screening for employees and vendors.
Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out.
Govern AI vendors and subprocessors.
Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales.
Finish the Vanta migration and publish a trust center with standard collateral.
Finalize and test the BCDR and incident response plans.
Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage.
Present a 12-month security and certification roadmap to the CTO.