InfoSec Engineer (Risk and Compliance)
Rox Data Corp1 day ago
Base Salary
$180k - $220k/yr
Responsibilities
- Build Python scripts and REST API integrations that collect evidence, monitor controls, and generate compliance reports.
- Own the ISO 27001 certification program, including audit findings, the Statement of Applicability, the risk register, and internal audits.
- Maintain continuous SOC 2 compliance by fixing failing tests, responding to evidence and auditor requests, maintaining policies, and running access reviews.
- Manage the customer security review queue, including CAIQ, SIG, and custom questionnaires, security addenda, and due diligence calls.
- Assess vendors and subprocessors and maintain the vendor risk register.
- Partner with Engineering and Infrastructure on AWS, software development lifecycle controls, change management, and vulnerability fixes.
- Partner with Legal and Finance on data processing agreements, customer security addenda, and vendor procurement.
- Take ownership of ISO 27001, SOC 2, customer security diligence, and vendor risk management with little supervision.
Requirements
- At least 4 years of experience in GRC or security compliance, including hands-on experience running SOC 2 and ISO 27001 audits.
- Experience writing Python scripts and API integrations for evidence collection and control monitoring.
- Comfort with SQL and Git.
- Working knowledge of AWS security services and logs, including IAM, CloudTrail, KMS, and Config.
- Experience with a GRC platform such as Secureframe, Vanta, or Drata.
- Experience answering enterprise security questionnaires such as CAIQ and SIG and participating in customer due diligence calls.
- Familiarity with GDPR and data processing agreement concepts.
- Ability to own outcomes with little supervision and explain risk clearly to engineers, executives, and customers.
- Located in or willing to relocate to San Francisco.
- Preferred experience leading an ISO 27001 certification or first SOC 2 Type II from scratch.
- Preferred experience with JumpCloud, Datadog, or Semgrep.
- Preferred experience managing third-party risk at a fast-growing B2B SaaS or AI company.
Benefits
- Base salary range of $180,000 to $220,000 USD, plus considerable equity upside.
- Medical, dental, and vision plans with 100% company-paid coverage for the employee and eligible dependents.
- Company-paid life and AD&D insurance, short- and long-term disability, and a 401(k) with automatic enrollment.
- Unlimited PTO, paid sick leave, company holidays, and bereavement leave.
- Up to 20 weeks of fully paid parental leave for birth, adoption, or foster care.
- Wellness stipend of up to $375 per quarter and learning stipend of up to $2,000 per year.
- Internet and cell phone stipend of $25 per month.
- Mental health support, virtual care, care navigation, fertility and family-building support, and backup care membership.
- Pre-tax commuter benefits, daily catered breakfast and lunch, meal allowances, and rideshare support at the San Francisco headquarters.
- Onsite work at Rox’s San Francisco headquarters five days per week.
About Rox Data Corp
Rox Data Corp builds AI-powered software and agentic automation to help sales, RevOps, and finance teams secure and grow revenue. Its products cover sales automation, revenue assurance, and fintech workflows, offered as subscription software and services. Founded in 2024 and headquartered in San Francisco, the privately held company maintains an in-office, five-days-a-week policy.