Director of Data, Security, and Compliance
About The Position
The Director of Data, Security, and Compliance owns Syllo's data security compliance function and reports to the Head of Legal, Security, and Compliance. The role ensures company processes and policies support certifications and meet auditor and client scrutiny. The position manages SOC 2 and ISO 27001 certification renewals, internal policies for handling sensitive information, client security information and vendor security questionnaire (VSQ) responses, software acceptance standards, incident response coordination, and compliance with applicable privacy regimes. This is a hands-on role building and scaling a program that is in progress rather than inheriting a mature function. The director will execute directly while developing policies and procedures, sometimes from scratch, and may grow into product-related security responsibilities and team building. The role requires ownership of compliance programs and judgment across legal, technical, and commercial considerations.
Requirements
- At least 5 years in a Director-level position or equivalent, overseeing an organization's overall security compliance or owning security compliance for its commercial function.
- Direct ownership of SOC 2 and ISO 27001 compliance programs.
- Demonstrated experience managing high-volume VSQ processes across enterprise sales pipelines.
- Experience developing security questionnaires and audit-cycle processes and tools for enterprise and law firm procurement teams under time pressure.
- Experience designing data-handling policies, disaster recovery documentation, and incident response procedures that withstand auditor and customer scrutiny.
- Understanding of how privacy regimes affect data storage and inquiry responses, with the ability to translate requirements into processes alongside engineering.
- Sound cross-functional judgment about when to escalate a compliance issue and when to resolve it at the working level.
- Technical fluency in the security infrastructure underlying compliance programs; able to understand the basics without being a hands-on engineer.
- Bachelor's degree required.
Nice To Haves
- Experience building compliance programs at high-growth B2B SaaS companies.
- CISSP, CISM, or equivalent certification.
- Advanced degree.
Responsibilities
- Manage SOC 2 Type II and ISO 27001 certification cycles end to end, including scope, evidence, auditor relationships, and remediation; ensure company processes and policies support the certifications.
- Own vendor security questionnaire responses across the enterprise sales pipeline, balancing quality and turnaround time.
- Design and maintain data-handling policies, disaster recovery plans, and incident response procedures.
- Define security and configuration standards that software must meet before adoption and approve additions against those standards.
- Coordinate responses to security issues according to the incident response plan, bringing in the appropriate owners rather than conducting technical investigations.
- Ensure data storage and inquiry-response processes comply with applicable privacy regimes, working cross-functionally with engineering on implementation.
- Advise across operations and commercial conversations as the compliance representative.
Benefits
- Equity options.
- Medical, dental, vision, and voluntary insurance options.
- Vacation, sick leave, and paid holidays.
- Access to benefit counselors.
- Fitness class reimbursements.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Director
