Lead - Security, Risk & Compliance

The Embrace Technology Group provides shared engineering, cloud, and security services across Embrace portfolio companies in education, government, and legal sectors. This remote role reports to the Director, Cloud Operations & Enterprise IT and works closely with the engineering team in India.

The Lead – Security, Risk & Compliance will establish and manage a centralized security and compliance framework across the portfolio, including policies, SOC 2 and other certifications, risk management, and customer security requirements. The role will be responsible for implementing security standards, addressing compliance gaps, and supporting enterprise customer requirements.

In addition to governance and compliance, this is a hands-on security role requiring strong technical expertise. The Lead will implement security controls, assess risks, evaluate security tools, and work closely with Security, CloudOps, and Engineering teams to strengthen security across the portfolio.

The role will initially focus on establishing common controls, supporting existing teams, and managing audits, with the security function expanding as the portfolio grows.

Key Responsibilities

Security, Risk & Compliance

• Develop, implement, and maintain a centralized security control framework, including policies, controls, and evidence templates across portfolio companies.
  
• Lead SOC 2 Type I and Type II engagements end to end, including readiness, control implementation, evidence collection, auditor coordination, and reporting.
  
• Lead ISO 27001 implementation and certification where required, including ISMS scoping, Statement of Applicability, internal audits, and management reviews.
  
• Manage applicable government, healthcare, education, and legal-sector security requirements, including HIPAA, FERPA, HECVAT, GovRAMP/StateRAMP, NIST 800-53, and contractual security obligations.
  
• Conduct security risk assessments, maintain risk registers, track remediation and exceptions, and escalate material risks for formal acceptance by business leadership.
  
• Manage vulnerability assessments, penetration testing, remediation priorities, and tracking of security findings across applications and infrastructure.
  
• Conduct third-party and vendor security assessments, including subprocessors, software supply chains, and AI vendors.
  
• Develop and maintain business continuity, disaster recovery, security awareness, and secure development standards, coordinating testing and compliance with operational teams.
  
• Manage customer security reviews, questionnaires, audit evidence, and external auditor interactions across portfolio companies.
  
• Establish and improve security processes, reporting, and controls across the portfolio, providing regular updates on risks, compliance, and remediation progress.
  

Technical Security Leadership & Operations

• Implement and improve security controls across cloud, application, and infrastructure environments, working with CloudOps and Engineering teams.
  
• Evaluate, configure, and optimize security tools, including Cloudflare/WAF, vulnerability scanners, SIEM, endpoint protection, and security monitoring platforms.
  
• Conduct technical security reviews covering IAM, SSO/SAML, encryption, API security, privileged access, customer data isolation, and third-party integrations.
  
• Assess security vulnerabilities, recommend remediation, and work with Engineering and Systems Administration to implement and validate corrective actions.
  
• Review cloud and infrastructure security configurations, including firewall policies, DDoS protection, access controls, and security hardening.
  
• Provide hands-on technical support and guidance to security analysts and engineering teams on security controls, tooling, compliance requirements, and complex security issues.
  
• Mentor security team members, establish security best practices, and improve internal capabilities through regular reviews and knowledge sharing.
  

• 10+ years of experience in cybersecurity, risk management, and compliance, including end-to-end ownership of SOC 2 Type II or ISO 27001 certification.
  
• Proven experience developing and implementing security policies, control frameworks, risk assessments, audit evidence, and remediation plans, using platforms such as Drata or Vanta.
  
• Strong hands-on experience with cloud and application security across AWS and/or Azure, including IAM, encryption, API security, secure development practices, and vulnerability management.
  
• Practical experience implementing and managing security technologies such as Cloudflare/WAF, firewalls, vulnerability scanners, SIEM, endpoint security, and monitoring tools.
  
• Experience conducting technical security assessments, identifying vulnerabilities, implementing security controls, and validating remediation with Engineering and CloudOps teams.
  
• Experience managing vendor risk, security audits, and customer security reviews, preferably within education, government, legal, or other regulated SaaS environments.
  
• Strong technical leadership, communication, and mentoring skills, with the ability to work independently and collaborate across multiple portfolio companies and distributed teams.
  

Nice to Have

• Experience with AI security and governance, including model risk assessments, prompt injection, data privacy, tenant isolation, and secure AI integrations.
  
• Familiarity with AI governance frameworks such as NIST AI RMF or ISO/IEC 42001, and privacy regulations such as GDPR.
  
• Experience with security and compliance requirements in FinTech or financial services, including protection of sensitive financial data.
  
• Knowledge of FedRAMP/StateRAMP, HECVAT, and security requirements for education, government, and legal SaaS environments. Certifications such as CISSP, CISM, CISA, CRISC, or CCSP are a plus.
  
• Experience securing Microsoft SQL Server, Windows Server, Java applications, SAML/Shibboleth, and managed hosting environments.