Security & Compliance Manager

IONIX is the leader in External Exposure Management (EASM). We protect enterprises from the next wave of mass-scale, AI-driven attacks by continuously discovering their external exposures, validating them, and helping close them fast. This year we doubled our customer base, now protecting many of the largest Fortune 500 companies, and launched three new agentic products: Live Exposure Defense, WAF Posture Management and Spark Hunt. We are hiring a hands-on Security & Compliance Manager to own security and compliance across our product, cloud and company. Full time, reporting to the CTO. You will own security at IONIX end to end and be the person customers, auditors and our teams turn to. This is a hands-on role: beyond policies and audits, you will implement security improvements yourself across our cloud, IT and DevOps environments, in coordination with the DevOps and IT teams. You will also work closely with Engineering and Sales. Requirements: 4+ years in security engineering, cloud security or technical GRC, ideally at a SaaS company. Hands-on cloud and IT security experience (Azure preferred), including making changes yourself: IAM, secrets, network and Kubernetes basics. Ran or played a major part in a SOC 2 or ISO 27001 audit. Experience answering customer security questionnaires and reviews (for example SIG or CAIQ). Enough scripting (Python or shell) and AI experience to automate evidence collection and checks. Excellent written and spoken English, and confidence with customers, auditors and leadership. Self-driven: you build programs from scratch and drive results across teams. Nice to have: background in offensive security, AppSec or attack surface management. Nice to have: certifications such as CISSP, CCSP, OSCP or Azure security. Nice to have: experience using AI tools to speed up compliance and questionnaire work. Responsibilities: Customer trust: answer security questionnaires and due diligence requests, join customer and prospect calls as the security voice. Compliance and audits: run our compliance programs (e.g. SOC 2) end to end (policies, control owners, evidence, auditors, gap remediation) and lead any new frameworks we need. Security roadmap and risk: maintain a prioritized roadmap and risk register, track remediation owners and deadlines, and report progress and risks to leadership. Cloud and corporate security: implement and own security controls across our Azure cloud, identity, Kubernetes and secrets management; run access reviews; configure and enforce endpoint, email and SaaS security together with IT. Product security: run design reviews and threat modeling with R&D, own secure development practices and CI/CD security scanning, and manage vulnerability remediation. Testing: plan and coordinate penetration tests and vulnerability assessments, validate findings and verify fixes. Incident response: own the IR plan, run tabletop exercises, lead investigations and turn lessons learned into fixes. Vendor and people security: assess third-party and AI-tool risk, run security awareness training, and own security in onboarding and offboarding.