IT, Security, and Compliance Manager

fav•Santa Monica, CA

1d•Onsite

About The Position

fav is hiring an IT, Security & Compliance Manager to own and build the systems, processes, and programs that keep the company secure, compliant, and operationally efficient. This hands-on role spans IT operations, information security, compliance, risk management, and vendor management. The manager will work with executive leadership, engineering, operations, and external partners to establish appropriate technology controls and security practices as fav grows. The role also involves determining which security and compliance certifications fav should pursue, developing a roadmap to achieve them, and maintaining relevant standards as customer, creator, and business requirements evolve. The position is full-time and on-site in Santa Monica, California. fav describes its culture as intense, fast-moving, collaborative, and suited to self-starters who value high standards, respectful communication, and real-time feedback.

Requirements

At least 5 years of experience across IT, information security, GRC, compliance, or a related field.
Experience owning or significantly contributing to IT and security programs within a startup or high-growth technology company.
Strong understanding of security frameworks, controls, risk management, and compliance requirements.
Experience building security and compliance programs from the ground up.
Familiarity with SOC 2, ISO 27001, GDPR, CCPA/CPRA, and other relevant security and privacy frameworks.
Experience managing security audits and certification processes.
Strong experience with identity and access management, SaaS administration, endpoint security, and IT operations.
Experience evaluating and managing IT and security vendors.
Ability to assess company needs and determine appropriate security certifications and compliance standards.
Strong organizational and project management skills, including the ability to manage multiple priorities.
Excellent communication skills and ability to work effectively with technical and non-technical teams.
Ability to operate independently and build processes where they do not yet exist.
High discretion, judgment, and ownership when handling sensitive company and user information.

Nice To Haves

Experience leading SOC 2 Type II or ISO 27001 certification efforts from planning through completion.
Experience in a consumer technology, gaming, social, livestreaming, or SaaS environment.
Experience supporting companies through rapid growth and increasing security or compliance requirements.
Familiarity with cloud environments such as AWS or GCP.
Experience with security and IT tools across identity, endpoint management, vulnerability management, SIEM, and compliance management.
Experience establishing a security program at a company with limited prior formal security infrastructure.
Relevant certifications such as CISSP, CISM, CISA, CRISC, or Security+.
A pragmatic approach to security that builds strong controls without unnecessarily slowing a fast-moving engineering organization.

Responsibilities

Own day-to-day IT operations, including systems, applications, access management, devices, identity, and employee technology.
Develop and maintain fav’s information security program, policies, standards, and controls.
Own security and compliance readiness, including identifying appropriate certifications and frameworks for the business.
Develop and manage a roadmap for certifications such as SOC 2, ISO 27001, or other relevant standards based on business and customer requirements.
Partner with engineering and infrastructure teams to ensure appropriate security controls, monitoring, access management, and infrastructure practices are in place.
Manage employee identity and access, including onboarding, offboarding, permissions, and periodic access reviews.
Establish and maintain policies for access control, acceptable use, data protection, incident response, and vendor risk.
Own or coordinate security audits, assessments, penetration tests, and compliance reviews.
Develop and maintain an incident response and security escalation process.
Manage technology and security vendors, including selection, evaluation, contracts, renewals, and ongoing performance.
Establish a third-party risk management process for vendors with access to company systems or data.
Partner with legal, finance, HR, and leadership on privacy, compliance, and risk-related initiatives.
Maintain accurate documentation and evidence for security and compliance programs.
Conduct regular risk assessments and identify opportunities to strengthen the company’s security posture.
Educate employees on security best practices, policies, and compliance requirements.
Help establish scalable IT and security processes to support the company as it grows.