Manager, IT Compliance & Vendor Management

The Landline Company • Fort Collins, CO

5d • $120,000 - $175,000 • Remote

About The Position

The Landline Company is seeking a Manager, IT Compliance & Vendor Management to build and operate its cybersecurity control program and oversee the managed service provider (MSP) responsible for day-to-day IT operations. The role owns MSP performance and the design, operation, and evidence of Landline’s control program mapped to the NIST Cybersecurity Framework (CSF) 2.0. The program must address internal risk requirements as well as security and data-handling requirements imposed by airline partners and airports in a regulated transportation environment.

The position also manages vendor security reviews and assurance, control testing and remediation, policies, risk tracking, security awareness, incident response, and business continuity and disaster recovery activities. It provides recurring compliance and vendor performance reporting to executive leadership and security and compliance guidance to procurement, legal, and operations.

The role is remote in a major metro area in Canada or the United States, with business travel as needed. Compensation is listed as 120,000–175,000.

Requirements

• Five or more years in IT compliance, information security, IT audit, or IT governance, including at least two years with direct responsibility for a control program or audit function.
• Hands-on experience implementing or operating a recognized security framework, such as NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls, or equivalent.
• Experience administering or serving as a primary user of a GRC or compliance automation platform, such as Vanta, Drata, Secureframe, LogicGate, AuditBoard, ServiceNow GRC, or equivalent.
• Experience managing or formally overseeing an outsourced IT provider, including service level monitoring and escalation.
• Working knowledge of core IT controls: identity and access management, endpoint management, logging and monitoring, vulnerability management, backup and recovery, and change management.
• Ability to critically read a SOC 2 Type II or similar report, including scope boundaries, exceptions, carve-outs, and complementary user entity controls.
• Clear written communication, as the role produces documentation that external parties read and rely on.

Nice To Haves

• Professional certification such as CISA, CRISC, CISM, or CISSP.
• Direct NIST CSF 2.0 implementation experience, particularly the Govern function and cybersecurity supply chain risk management (GV.SC).
• Experience in transportation, aviation, logistics, or another operationally regulated industry.
• Familiarity with PCI DSS, CCPA/CPRA, or state breach notification requirements.
• Prior experience building a compliance program from an early or undefined baseline.
• ITIL foundation or an equivalent service management background.
• Contract negotiation experience with technology vendors or service providers.

Responsibilities

• Maintain the company's control set mapped to all six NIST CSF 2.0 Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
• Administer the Vanta GRC platform, including integrations, control monitoring, evidence collection, automated test configuration, and remediation tracking.
• Perform periodic control testing and design effectiveness reviews; document results and drive remediation to closure with owners and due dates.
• Own the policy lifecycle, including drafting, annual review, approval routing, publication, and attestation tracking.
• Maintain the enterprise risk register, including risk scoring methodology, treatment decisions, and executive reporting.
• Prepare and coordinate evidence for customer security reviews, airline partner assessments, insurance questionnaires, and external audits or assessments.
• Administer the security awareness training program, including phishing simulation and completion tracking.
• Serve as the primary relationship owner for the MSP, managing escalations, scheduling, and day-to-day service delivery expectations.
• Monitor and report contracted service levels, document breaches, drive root-cause analysis, and enforce contractual remedies where warranted.
• Chair quarterly business reviews with the MSP, set agendas, track commitments, and maintain an action log.
• Own the MSP contract lifecycle, including scope changes, renewals, pricing negotiation, and the exit and transition plan.
• Verify that MSP-operated controls function as contracted by requiring evidence.
• Govern access administration performed by the MSP, including joiner/mover/leaver execution, privileged access review, and periodic user access certification.
• Maintain the responsibility assignment matrix (RACI) defining controls operated by the MSP, Landline, or both.
• Operate the vendor intake and security review process for new technology purchases.
• Maintain the vendor inventory, including data classification, criticality tiering, and review cadence.
• Collect and review third-party assurance artifacts, including SOC 2 Type II reports, ISO 27001 certificates, and penetration test summaries; analyze complementary user entity controls and qualified opinions.
• Track vendor contract security terms, breach notification obligations, and data processing agreements.
• Maintain the incident response plan and coordinate the annual tabletop exercise.
• Serve as compliance lead during security incidents, covering evidence preservation, regulatory notification analysis, and post-incident reporting.
• Maintain business continuity and disaster recovery documentation and coordinate annual restoration testing with the MSP.
• Deliver recurring compliance and vendor performance reports to executive leadership.
• Provide security and compliance input to procurement, legal, and operations.
• Track and report program metrics.

Benefits

• Comprehensive benefits and PTO plan, including medical, dental, vision, 401(k), disability, parental leave, and company-paid life insurance.
• Flight benefit privileges with airline partners.
• Discretionary PTO.
• Significant opportunity for growth as the company scales.

What This Job Offers

• Job Type: Full-time
• Career Level: Manager
• Education Level: No Education Listed