Security Compliance Engineer

Syllo

9d•$180,000 - $200,000•Remote

About The Position

Syllo is hiring a Security Compliance Engineer to own the technical security layer underlying its compliance program. Reporting to the Director of Data Security Compliance, this engineering role implements and operates the technical controls and documents the work for audits. The role executes standards set by the Director and does not author company policy. It requires hands-on experience implementing security controls across cloud infrastructure and endpoint configuration, with a focus on making compliance controls defensible in enterprise audits. The engineer will support SOC 2 and ISO 27001 controls, identity and access management, endpoint security, security monitoring, technical incident response, and customer data segregation. The role partners with the Director on policy, legal, and client-notification aspects of incidents, and with product engineering on customer data isolation controls.

Requirements

At least 3 years of experience in security engineering or DevSecOps, including hands-on implementation experience.
Hands-on experience implementing Vanta or comparable compliance automation tooling and connecting evidence sources and maintaining control status.
Proficiency with cloud security controls in AWS, GCP, or Azure.
Experience implementing security controls in cloud environments; GCP is preferred.
Experience with SSO providers such as Okta or Google Workspace, IAM policy design, and least-privilege enforcement.
Experience with MDM platforms such as Jamf, Kandji, or similar, and endpoint compliance monitoring.
Experience building and running incident response runbooks.

Nice To Haves

Security certification such as Security+, AWS Security Specialty, or equivalent.
Bachelor's degree in computer science, information security, or a related field.

Responsibilities

Implement, configure, and monitor technical controls supporting SOC 2 and ISO 27001, including Vanta, SSO, endpoint management, and security monitoring.
Design and operate IAM policies, enforce least-privilege access, and maintain correctly configured SSO across the technology stack.
Manage device enrollment, MDM policy, and endpoint compliance across a distributed team.
Own incident detection, triage, and technical response, and maintain incident response runbooks.
Coordinate with the Director of Data Security Compliance on policy, legal, and client-notification aspects of incident response.
Implement controls that enforce customer data isolation and verify them against contractual data handling obligations.
Partner with product engineering, which architects the platform itself.
Document implemented controls and work for audit.