Head Of Cybersecurity

Irth Solutions

9h • $195,000 • Hybrid

About The Position

Irth is seeking a hands-on cybersecurity leader to strengthen and oversee its security program for SaaS solutions used by utility and infrastructure operators. The role combines technical execution with security policy and program ownership, working closely with engineering, infrastructure, IT, GRC, and executive leadership. The successful candidate will turn security findings into actionable remediation, lead incident response, establish security standards, and communicate Irth’s security posture to customers and other stakeholders.

The role owns vulnerability management and remediation, incident response and related communications, cloud security across AWS and Microsoft Azure, identity and access controls, and the technical security controls supporting SOC 2 Type II and ISO 27001. It also develops and enforces policies aligned with NIST CSF and relevant customer and regulatory expectations, supports audits and customer security reviews, manages penetration-testing engagements and security vendors, and supports acquisition due diligence.

This is a new position. The stated base salary is USD $195,000; offers may depend on experience, skills, and location. The role may use AI or automated tools to assist in reviewing and screening applications, but these tools support rather than replace human judgment.

Requirements

• At least 8 years of experience in cybersecurity engineering or security operations, including at least 3 years leading a security program or function; experience in a SaaS organization is preferred.
• Hands-on cloud security experience across AWS and Microsoft Azure, including IAM, cloud network security controls, security logging, monitoring and audit trails, AWS CloudTrail, Microsoft Entra sign-in and audit logs, and cloud security posture management tools such as Wiz.
• Demonstrated end-to-end ownership of vulnerability management, including identifying, triaging, prioritizing, assigning, tracking, and driving remediation with engineering teams.
• Experience leading security incident response, including clear, timely written communications to executive leadership and customers under pressure.
• Working knowledge of SOC 2 Type II, ISO 27001, and NIST CSF, including experience as a key technical control owner through at least one SOC 2 Type II audit.
• Ability to review and interpret application code, infrastructure-as-code, and Linux and Windows server configurations to evaluate security risks and validate remediation approaches.
• Strong written and verbal communication skills, sound technical judgment, and ability to distinguish issues requiring immediate escalation from those appropriate for routine remediation.

Nice To Haves

• Experience supporting utilities, pipelines, energy providers, or other critical-infrastructure customers, including familiarity with TSA pipeline security directives or NERC CIP requirements.
• Familiarity with Canadian privacy requirements, including Quebec’s Law 25.
• Experience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.
• Experience conducting cybersecurity due diligence or supporting security integration related to mergers and acquisitions.
• Relevant industry certifications; the posting begins an example with “Certified Information Systems” but does not specify a complete certification name.

Responsibilities

• Own triage and prioritization of security findings from SAST tools, infrastructure assessments, penetration tests, and newly disclosed CVEs; assess risk, assign owners and deadlines, and report progress, outstanding risks, and trends.
• Partner with engineering and infrastructure teams to remediate vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning; ensure findings have owners, tracking tickets, and target remediation dates.
• Provide appropriate vulnerability and remediation updates to customers.
• Lead security incident response from detection and investigation through containment, remediation, and post-incident review; coordinate urgent vulnerability and CVE responses.
• Manage incident communications, including internal status updates, executive briefings, and Customer Experience talking points, and prepare timely customer-facing communications about potential exposure, remediation, and detection activities.
• Maintain incident response runbooks and on-call escalation procedures and conduct regular tabletop exercises.
• Own cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.
• Establish and enforce identity and access management policies for least privilege, role-based access, session duration and expiration, MFA, privileged access, and employee and contractor lifecycle changes.
• Strengthen identity controls across Microsoft Entra ID and AWS IAM; conduct access reviews and remediate excessive permissions, inactive accounts, and access control gaps.
• Develop, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST CSF and ISO 27001.
• Own technical security controls supporting SOC 2 Type II and ISO 27001 compliance; partner with GRC on audit readiness, evidence collection, and control-gap remediation.
• Translate relevant regulatory and customer requirements into practical technical controls, including requirements related to TSA pipeline security directives, NERC CIP-related customer expectations, and applicable Canadian privacy legislation.
• Lead technical responses to customer security questionnaires with GRC and represent Irth’s cybersecurity program in customer security reviews and calls.
• Manage third-party penetration-testing engagements and security vendors; support cybersecurity due diligence for acquisitions.
• Drive security findings through resolution, establish accountability and measurable remediation timelines, balance security risk with business and operational priorities, and communicate security issues clearly to technical and nontechnical audiences.

Benefits

• Medical, dental, and vision coverage through health plan options.
• 401(k) plan with company match.
• Flexible PTO policy and company-paid holidays.
• Life insurance.
• Pet insurance.
• Employee discounts and perks programs.
• One-time work-from-home stipend.
• Company events, monthly team lunches, volunteer outings, and quarterly gatherings.
• Complimentary snacks, beverages, and coffee at the Columbus, Ohio office for hybrid employees.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed