VP, Information Security and Compliance

Veritone

8d•$200,000 - $250,000

About The Position

The VP, Information Security & Compliance, will serve as the Company’s Chief Information Security Officer and executive champion for our global enterprise security and compliance programs. Reporting directly to the Chief Legal Officer, this role will design, execute and mature an overarching security strategy that protects customer data, intellectual property and infrastructure across all of Veritone’s business units, including, but not limited to commercial SaaS and high stringency public sector (federal, state and defense) environments. The role requires a rare blend of strategic vision, commercial SaaS agility, public sector governance (e.g., FedRAMP, NIST, DoD), and public company risk management capabilities (e.g., SOX, SEC disclosure requirements).

Requirements

Bachelor of Science degree in Computer Science, Cybersecurity, Computer Engineering, Information Technology, or equivalent technical discipline.
10+ years of progressive leadership experience in information security, cloud architecture, and compliance within a global, publicly traded cloud/SaaS technology company.
Hands-on experience leading a cloud solution through the FedRAMP authorization lifecycle (PMO/JAB or Agency route) and continuous monitoring in AWS and/or Azure cloud environments.
Equal fluency in scaling commercial enterprise SaaS security and navigating rigid public sector regulatory landscapes (NIST 800-53, NIST 800-171, CMMC, CJIS, FISMA).
Exceptional ability to communicate security concepts to technical engineers, enterprise buyers, regulatory auditors, and Board members alike.
Demonstrated success negotiating security exhibits, data processing agreements (DPAs), and risk terms with enterprise clients and vendors.

Nice To Haves

Master’s degree (M.S. in Cybersecurity/Computer Science or MBA).
Active professional certifications such as CISSP, CISM, CRISC, CISA, or CCSP.
Active or clearable U.S. Government Security Clearance (DoD Secret or Top Secret preferred).
Knowledge of security, privacy, and governance frameworks surrounding Artificial Intelligence and Machine Learning workloads.

Responsibilities

Architect and execute a multi-year, enterprise wide information security and compliance strategy aligned with commercial growth targets and public sector expansion goals.
Serve as the primary security advisor to the Board of Directors, Executive Leadership Team and entire organization. Clearly translate complex security risks into actionable business terms.
Build, mentor and lead a high performing global security team and compliance organization across security operations, engineering, risk management and regulatory compliance.
Foster a company-wide security first culture through continuous training, awareness programs and cross-functional advocacy.
Lead the strategy, deployment and continuous monitoring required to achieve and maintain FedRAMP (moderate/high), StateRAMP, DoD/CMMC, and CJIS authorizations in cloud environments (AWS GovCloud/Azure Government).
Oversee compliance and auditing for SOC 2 Type II, ISO 27001, PCI-DSS and global privacy standards (GDPR, CCPA/CPRA).
Partner with legal, finance and internal audit teams to maintain robust IT general controls (ITGCs) for SOX compliance and support SEC cybersecurity disclosure requirements.
Partner with Enterprise Architecture, Infrastructure, and Engineering teams to embed security controls into multi-tenant SaaS platforms, CI/CD pipelines, and cloud environments.
Direct vulnerability scanning, penetration testing, intrusion detection, and threat intelligence operations to proactively address emerging vector threats.
Oversee breach investigations, threat response protocols, and tabletop exercises, ensuring rapid containment, notification, and mitigation when incidents arise.
Establish and enforce third-party risk management (TPRM) programs to audit and secure vendor ecosystems, software supply chains, and external partners.
Lead security and compliance due diligence for mergers and acquisitions, driving post-acquisition security integration strategies.
Construct policies and operational frameworks for Business Continuity Planning (BCP), Disaster Recovery (DR), loss prevention, and fraud prevention.