Director of Security & Risk

SentiLink

4d•$200,000 - $260,000•Remote

About The Position

SentiLink is hiring a Director of Security & Risk to lead its security governance, compliance, assurance, and risk management programs. The role has broad ownership across FedRAMP, SOC 2, PCI DSS, customer and partner security assessments, third-party risk, and security policy. It requires a deep technical understanding of SentiLink’s AWS-based environment and the ability to independently evaluate technical risks, security architecture, and proposed remediations while working with engineers, auditors, regulators, and business stakeholders. The Director will lead and develop a team of security and compliance professionals, set priorities, identify program gaps, and create a roadmap to improve SentiLink’s security posture. The position reports to SentiLink’s security leader and works closely with Security Engineering, a separate function responsible for technical security architecture and implementation. Success means building a proactive, effective, and scalable security program that meaningfully reduces organizational risk beyond audit readiness. This is a remote, US-based position. SentiLink supports working arrangements ranging from fully remote to in-office and collaborates across the U.S. and India.

Requirements

10+ years of experience in information security, including significant experience leading security governance, compliance, assurance, or risk management programs.
Demonstrated experience owning major security compliance and assurance programs such as FedRAMP, SOC 2, PCI DSS, or comparable regulatory frameworks, including direct engagement with auditors, assessors, and external stakeholders.
Strong technical understanding of modern cloud infrastructure, SaaS application security, identity and access management, vulnerability management, and security architecture, with the ability to independently evaluate technical findings, control designs, and remediation approaches.
Ability to build and improve security programs, independently identify control gaps and emerging requirements, establish priorities, and translate security risks into actionable organizational plans.
Experience managing and developing security professionals, setting high standards for quality and accountability, and leading programs across distributed teams.
Experience with third-party risk assessments, customer security diligence, and security risk management, including evaluating complex technical and contractual security requirements.
Strong written and verbal communication skills, sound judgment, and the ability to influence engineering teams, business leaders, auditors, and external stakeholders without relying solely on formal authority.

Responsibilities

Lead and develop the security governance, risk, and compliance organization; mentor professionals, evaluate program effectiveness, identify expertise and capacity gaps, and develop organizational and hiring plans.
Own security compliance and audit programs, including FedRAMP, SOC 2, and PCI DSS; lead external assessments, manage control effectiveness and evidence collection, oversee Vanta and compliance automation, and maintain continuous compliance.
Oversee the government security program, including FedRAMP continuous monitoring, POA&M governance, change-management compliance, agency-specific requirements, and assessment readiness; anticipate evolving requirements such as FedRAMP 20x.
Establish and operate a security risk management program covering the identification, assessment, documentation, escalation, and treatment of security risks, control deficiencies, and exceptions, and track remediation through completion.
Lead the third-party security risk management program by setting risk-based vendor diligence requirements, improving assessment quality, managing ongoing oversight, and ensuring material concerns are resolved or escalated before approval.
Lead customer and partner security assurance, including complex assessments and audits; evaluate contractual security requirements with Legal, coordinate technical responses, and ensure security representations are accurate, complete, and defensible.
Own security policy and control governance, maintaining policies, standards, and control frameworks and ensuring requirements are mapped to regulatory obligations, reflected in operations, and periodically evaluated.
Improve the effectiveness and scalability of security programs through clear accountability, measurable outcomes, repeatable processes, and automation; identify emerging risks and requirements, communicate recommendations to leadership, and drive cross-organizational improvements.