Security Compliance Manager

Hive•San Francisco, CA

55d•$140,000 - $180,000

About The Position

We are looking for a highly motivated Security Compliance Manager with a deep security and compliance background to lead system development and process improvement. As part of Hive’s Security Team, you will collaborate with engineers and auditors to meet security compliance controls as well as enhance security compliance capabilities. As a Security Compliance Manager, you will oversee the execution of our Information Security program for evaluating compliance with industry standards (ISO, SOC), federal regulations, and customer contractual requirements. You will have complete ownership and accountability of programs from start to finish, aimed at improving the Hive Company personnel screening compliance and risk monitoring. The ideal candidate is comfortable interacting with both technology and business leaders across the organization at all levels. You will drive consensus among stakeholders and verify that controls are effective, or remediated to become effective.

Requirements

Bachelor's degree or related experience
Minimum 4+ years experience related to conducting risk-based assessment for information systems and/or operations
Minimum 1+ years experience running a comprehensive Governance, Risk and Compliance program
Minimum 2+ years experience leading industry standard (ISO 27001 or SOC 1/2) audits from either side
Strong knowledge of applicable privacy laws (CCPA/CPRA, GDPR)
Thorough understanding of vulnerability management, penetration testing, and attack simulations
Experience supporting enterprise-wide Security Compliance programs designed to anticipate, assess, and minimize control gaps and audit findings
Ability to communicate in a written and oral format to technical and non-technical audiences in a business-friendly manner
Demonstrated success in a competitive environment
Highly self-motivated and ambitious in achieving goals
Strong team player, but can work and execute independently
Driven; no one needs to push you to excel; that’s just who you are
Hungry to learn and actively look for opportunities to contribute
Highly organized and detail-oriented; can handle multiple projects and dynamic priorities without missing a beat

Responsibilities

Manage Hive’s current risk management program
Manage external and internal audits, including reviewing materials that require attention for accuracy and properly adhering to regulatory expectations
Implement ISMS in coordination with executive and mid-level management
Develop reports that capture key business trends, highlights, lowlights, and metrics as the compliance programs are conducted. Provide status, recommended updates, and detailed metrics and evidence
Work with Engineering and Product teams to identify process improvements and efficiencies in areas of change management, access management and general technology process controls
Provide compliance, risk, and controls expertise to support information security and compliance initiatives
Protect the business by assisting with cyber security risk assessments
Maintain awareness of industry best practices for data maintenance handling as it relates to your role
Manage a comprehensive Governance, Risk and Compliance program
Adhere to and champion policies, guidelines and procedures pertaining to the protection of information assets
Manage external security, privacy, and compliance requirements, including both internal requirements for vendors as well as external requirements placed on Hive
Report actual or suspected security and/or policy violations/breaches
Define, develop, implement, and maintain our policies and processes that enable consistent, effective privacy practices that minimize risk and ensure the confidentiality of protected information, paper and/or electronic, across all media types and comply with applicable privacy laws and regulations
Support Hive’s security review process from beginning to end by identifying all necessary internal stakeholders based on the request (e.g., security survey, audit, review), assembling relevant and appropriate documentation, drafting responses, scheduling and leading calls/meetings, and communicating follow-up activities
Serve as a subject matter expert for information security principles and practices (especially as they pertain to vendors and cloud security), and promoting a culture of security throughout the firm
Interface with staff throughout the firm to facilitate the efficient and secure use of technology services