14 hours ago
Base Salary
$140k - $210k/yr
Responsibilities
- Own internal and external security and privacy audits from scoping and readiness through fieldwork, evidence delivery, and findings resolution.
- Identify framework gaps, define remediation strategies, and drive implementation for new certifications and regulations.
- Author and maintain security policies, standards, procedures, testable requirements, review processes, and exception management.
- Design and assess security and privacy controls, provide technical guidance, and diagnose deficiencies using configurations, documentation, security-tool data, and application code.
- Define control-health metrics and build continuous monitoring and evidence pipelines.
- Automate control testing, evidence collection, identity governance, security Q&As, and other Trust & Compliance workflows.
- Identify risks and opportunities, set program strategy and KPIs, plan work, report progress, delegate effectively, and mentor practitioners.
Requirements
- In-depth understanding of multiple security and privacy frameworks, including NIST CSF 2.0, CIS Critical Security Controls, CSA STAR, ISO 27001, ISO 27002, ISO 27017, ISO 27018, ISO 27701, ISO 42001, SOC 1, SOC 2, PCI, HIPAA, SOX ITGCs, GDPR, CCPA, and CPRA.
- Demonstrated ownership of security and privacy compliance audit programs, including primary interface responsibilities with internal and external auditors.
- Experience writing precise security policies and standards and managing their review and exception processes.
- Deep experience designing, assessing, and continuously monitoring security and privacy controls.
- Experience with GRC engineering, security automation, enterprise SaaS applications, cloud infrastructure, software engineering practices, databases, operating systems, secure network design, and cybersecurity technologies.
- Experience owning programs against defined KPIs and SLAs and leading through delegation and technical mentorship without formal authority.
- Strong interpersonal, verbal, written communication, collaboration, prioritization, and execution skills.
- Preferred experience with Drata, Vanta, Anecdotes, HyperProof, SQL, REST APIs, Python, Terraform, OPA/Rego, Conftest, MCP, agent skills, evals, guardrails, ISO 42001, NIST AI RMF, identity governance, UARs, JITA, security operations, security engineering, or security architecture.
- Relevant certifications such as CISA, CISSP, or CCSP are preferred.
Benefits
- Base salary range is $140,000–$210,000 USD, with possible bonus, equity, sign-on payments, and health, welfare, and wellbeing benefits.
- The role may require up to 10% travel for onboarding, client or partner work, team meetings, and industry events.
- Klaviyo provides accommodations as needed and emphasizes equal opportunity, collaboration, and employee wellbeing.
About Klaviyo
Klaviyo builds a subscription SaaS platform that lets e-commerce and consumer brands use first-party data to run targeted email, SMS, and push campaigns, with built-in automation and analytics. The product also includes B2C CRM features for segmentation, A/B testing, and customer lifecycle workflows. Founded in 2012 and headquartered in Boston, it is a public company (NYSE: KVYO) used by brands such as Mattel and Glossier.