Senior InfoSec Manager

About First Connect:

First Connect Insurance Services is a digital marketplace providing independent insurance agents access to top US carriers and the optionality necessary to grow their businesses. Agents can work with 130+ carriers, selling various insurance policies, including home, auto, small business, and more. We’re on a mission to overhaul the technology agents have access to, putting consumer-grade software at their fingertips. We’ve got thousands of active agents with hundreds joining monthly, and we plan to accelerate our growth.

The Role:

We’re looking for a Security Manager to own and lead our Information Security function. You’ll serve as our security leader, including acting as the designated CISO for NYDFS 500 regulatory purposes.

This is a hands-on role responsible for maintaining our security posture, running compliance programs, and leading incident response. You’ll work closely with our IT and Engineering teams to ensure security is embedded across the organization.

We’re a 100-person, globally distributed startup with teams across the US, Poland, and Israel. You should expect regular collaboration and meetings with US-based colleagues.

What You’ll Do:

Security Culture & Awareness

• Be the voice of security across the company — educate and evangelize security best practices at all levels.
• Own employee security training programs, including onboarding and ongoing awareness initiatives.
• Run phishing simulations and other exercises to keep security top of mind.

Security Operations & Incident Response

• Own endpoint security across a mixed Mac/Windows environment.
• Manage and optimize our security tooling stack.
• Lead incident detection, response, and post-mortems.
• Monitor for threats and vulnerabilities across our infrastructure and SaaS applications.

Compliance & Risk

• Maintain SOC 2 Type II and NYDFS 500 compliance.
• Act as the designated CISO for NYDFS 500 regulatory purposes.
• Own audit preparation and manage relationships with external auditors.
• Conduct risk assessments and maintain security policies and procedures.

Application & Cloud Security

• Partner with engineering on secure development practices.
• Support security reviews of our AWS/Kubernetes infrastructure.
• Advise on identity and access management (Auth0, Entra).

Collaboration & Processes

• Collaborate closely with IT and Engineering teams.
• Establish processes and documentation that scale.

What You Bring:

Experience

• 5+ years in information security, with hands-on experience across multiple domains (endpoint, cloud, compliance, incident response).
• Experience maintaining SOC 2 and/or financial services compliance (NYDFS 500, SOX, or similar).
• Familiarity with cloud environments — AWS experience strongly preferred.
• Background working with SaaS-heavy, remote-first organizations.
• Startup or fintech experience is a strong plus.

Traits

• High ownership mindset — you’re comfortable rolling up your sleeves and building from zero.
• Strong written and async communication skills — you document clearly and thoroughly.
• Pragmatic and risk-based — you understand the difference between compliance theater and real security.
• Low ego, high impact — you work collaboratively and take responsibility for outcomes.

Certifications (Preferred, Not Required)

• CISSP, CISM, or equivalent.
• AWS Security Specialty or other cloud security certifications are a plus.

Location & Logistics:

• Hybrid role based in Tel Aviv (office adjacent to a train station).
• Work primarily in Israel time zone with regular overlap with US-based colleagues, including some US West Coast hours.