Security & Compliance Manager

Description:

IONIX is the leader in External Exposure Management (EASM). We protect enterprises from the next wave of mass-scale, AI-driven attacks by continuously discovering their external exposures, validating them, and helping close them fast. This year we doubled our customer base, now protecting many of the largest Fortune 500 companies, and launched three new agentic products: Live Exposure Defense, WAF Posture Management and Spark Hunt.

We are hiring a hands-on Security & Compliance Manager to own security and compliance across our product, cloud and company. Full time, reporting to the CTO.

You will own security at IONIX end to end and be the person customers, auditors and our teams turn to. This is a hands-on role: beyond policies and audits, you will implement security improvements yourself across our cloud, IT and DevOps environments, in coordination with the DevOps and IT teams. You will also work closely with Engineering and Sales.

• Customer trust: answer security questionnaires and due diligence requests, join customer and prospect calls as the security voice.
• Compliance and audits: run our compliance programs (e.g. SOC 2) end to end (policies, control owners, evidence, auditors, gap remediation) and lead any new frameworks we need.
• Security roadmap and risk: maintain a prioritized roadmap and risk register, track remediation owners and deadlines, and report progress and risks to leadership.
• Cloud and corporate security: implement and own security controls across our Azure cloud, identity, Kubernetes and secrets management; run access reviews; configure and enforce endpoint, email and SaaS security together with IT.
• Product security: run design reviews and threat modeling with R&D, own secure development practices and CI/CD security scanning, and manage vulnerability remediation.
• Testing: plan and coordinate penetration tests and vulnerability assessments, validate findings and verify fixes.
• Incident response: own the IR plan, run tabletop exercises, lead investigations and turn lessons learned into fixes.
• Vendor and people security: assess third-party and AI-tool risk, run security awareness training, and own security in onboarding and offboarding.