Information Security Manager, Product & Platform Security

LineVision, Inc.•Boston, MA

10h•$140,000 - $180,000•Onsite

About The Position

LineVision is seeking an Information Security Manager to lead and advance security across its products and enterprise environment. Reporting to the VP of Security, IT & Quality, the role has broad autonomy across security engineering, operations, controls, governance, and compliance. The manager will guide the security of LineVision’s AWS platform, RS-1 optical and weather sensors, SaaS platforms, identity and access management, endpoints, and other company systems, working closely with IT, Platform, Hardware, Customer Success, Sales, and Legal. The position owns the SOC 2 Type II and ISO 27001 audit cycles, risk management and governance, vulnerability management, incident response, penetration testing, customer security reviews, and confidential data protection. It also includes assessing security risks and setting standards for enterprise and product AI, supporting AI governance, and coaching the Security Analyst. The role may include a compensated rotational on-call schedule after onboarding. The first-year priorities include establishing security-team operating processes; taking ownership of audits, risk registers, and security projects; completing SOC 2 Type II and ISO 27001 surveillance audits and an IEC 62443 product security assessment; improving vulnerability management, detection, and SIEM coverage; conducting penetration tests and an incident-response tabletop; developing a multi-year security roadmap; and reporting ISMS effectiveness metrics and governance reviews to leadership.

Requirements

At least 6 years of experience in information security.
At least 2 years in a lead or people-management role.
Direct ownership of SOC 2 Type II and ISO 27001 audits, rather than support-only experience.
Experience conducting risk assessments using NIST CSF or an equivalent framework.
Hands-on experience with penetration test management, vulnerability management, and EDR/SIEM tooling.
Experience with AWS cloud security.
Experience responding to enterprise customer security questionnaires and contract requirements.
CISSP certification or commitment to earn it within 18 months of the start date.
Applicants must be currently authorized to work in the United States on a full-time basis; the position is not eligible for employment visa sponsorship.

Nice To Haves

Experience with OT/ICS or IoT security, including IEC 62443.
Familiarity with utility-sector requirements such as CEII and NERC CIP, or other regulated critical infrastructure.
Experience leading incident response for a real event.
Experience with Vanta or similar compliance automation.
Experience in AI governance and/or assessing the security of AI tools and features.
Experience with CrowdStrike.

Responsibilities

Own the annual SOC 2 Type II and ISO 27001 audit cycles, including controls, internal and external audits, and tracking nonconformities through closure.
Lead the annual NIST CSF risk assessment, monthly Platform and Hardware risk reviews, and quarterly Governance, Risk & Compliance reviews.
Maintain security policies and report ISMS effectiveness metrics to leadership.
Conduct AWS cloud and sensor penetration tests, ISA/IEC 62443 product security assessments, and vendor and product risk assessments.
Oversee vulnerability management, CrowdStrike Falcon Complete detection rules, NextGen SIEM data feeds, the MSSP relationship, and open-source license compliance using FOSSA.
Own the incident response program and plan, including an annual third-party tabletop, business continuity and disaster recovery exercises, and implementation of lessons learned.
Define and guide confidential data management controls and partner with Platform, Hardware, and IT to apply controls across company systems and applications.
Lead responses to customer security questionnaires, contract security reviews, and customer-facing security presentations and materials.
Identify AI security risks and define security standards for enterprise and product AI; inform the AI governance program with risk assessments and recommendations.
Coach and develop the security team, including the Security Analyst.
Establish security-team operating rhythms, intake and prioritization processes, and a reusable library for customer security responses.
Propose a two- to three-year security roadmap covering tooling, budget, and resourcing as the company grows.
Plan and conduct a purple team exercise, address findings, and define security requirements for next-generation sensors and platform features.