Oneleet

Role Description The Security Program Manager is part vCISO & part account manager. You will work with our customers from the start to assess their current security/compliance framework, provide guidance and recommendations for improvements, and work with clients to implement recommendations. You're passionate about security, and enjoy sharing your knowledge with not only our customers but your colleagues. Key Responsibilities - Conduct initial consultation calls with new clients to assess their current security posture, infrastructure stack, compliance requirements and overall objectives. - Provide guidance and recommendations for improving client security posture. - Develop high-level security programs consisting of technical, operational and administrative controls based on industry frameworks and client needs. - Collaborate with clients to customize and refine the security program to match their specific use cases. - Communicate with clients and stakeholders to ensure smooth and efficient security program creation. - Liaise with auditors to ensure clients' security programs align with auditors' expectations. - Maintain expertise across a range of security frameworks, control types, and technologies including NIST, SOC2, ISO27001, CMMC, AWS, Azure, GCP, Kubernetes, Docker, Terraform, and more. - Provide feedback to Oneleet's engineering team to inform development of integrations, solutions, and products that deliver on client needs. - Be highly technical, learn new technologies quickly, and translate security concepts into implementations. - Partner with internal teams to translate security programs into implementations consisting of policies, procedures, configurations and software integrations. Qualifications - 4+ years in a role involving information security, compliance, or audit (security operations, GRC, vCISO, security advisory, IT/Compliance auditing, or a security-adjacent customer success/IT support role). - Working and broad knowledge of security best practices, major compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR, PCI), and how controls map to real infrastructure and operations. - Technical Account Management experience, or client facing or stakeholder facing experience with strong project management instincts. - Ability to understand client infrastructure and map security controls to meet compliance goals and the bigger picture of holistic security and compliance. - Strong analytical skills to evaluate environments and determine appropriate safeguards. - Excellent verbal and written communication skills. - Self-driven with the ability to work independently, comfortable with ambiguity, and able to adapt approach client-by-client in a fast-moving startup environment. - Willingness to go the extra mile to meet tight deadlines and deliver results. Requirements - One or more of the following certifications: CISA, CISSP, CISM. - Exposure to a “Lead Auditor” scope (cross-framework, whole-program view) rather than a single specialty area. - Prior experience in customer success, IT support, or technical support background. Benefits - Comprehensive health & wellness benefits. - 20 days PTO per year, plus 8 floating holidays. - Remote work culture. - Team off-sites in stunning places (Amsterdam, Italy, etc). - Competitive compensation & equity.

• Own the full renewals cycle: tracking upcoming renewals, leading renewal conversations, negotiating terms, and closing on time. • Build the renewals process from scratch: renewal timelines, escalation paths, risk triggers, and the cadence for engaging customers ahead of their renewal date. • Design and maintain renewal reporting and forecasting: build the models and dashboards that show renewal rates, at-risk revenue, gross/net retention, and forecast accuracy, and report on them to leadership. • Develop an early-warning system to flag at-risk accounts and partner with CS to intervene before churn. • Establish renewal data hygiene in the CRM so renewals are tracked accurately and reporting is trustworthy. • Surface trends from renewal outcomes to inform pricing, packaging, and product decisions. • Partner cross-functionally with CS and Finance to align on retention targets and process.

• Build and maintain integrations with cloud providers (AWS, GCP, Azure) and third-party security tools to discover resources, sync configurations, and surface relevant security data • Design data pipelines that normalize and validate inputs from diverse APIs, handling inconsistencies, pagination, rate limits, and evolving schemas • Implement authentication flows including OAuth 2.0, OIDC, API keys, and service accounts across a wide range of external services • Ensure integrations are reliable, observable, and recoverable — with solid error handling, retry logic, and alerting when things go wrong • Create clear documentation for integration behavior, data mappings, and troubleshooting guidance • Improve engineering standards, tooling, and shared patterns that make future integrations faster to build • Collaborate with the broader engineering team to understand what data downstream features need and make sure integrations deliver it consistently

• Own the roadmap and sequencing for our code security bundles, prioritizing modules across need / want / nice-to-have tiers • Make scope tradeoff calls quickly under deadline pressure, including what to cut to ship on time • Work directly with design on mock-ups before engineering begins, providing product direction without requiring detailed specs • Partner with engineering leadership on technical tradeoffs and sequencing of dependencies across modules • Run design partner programs and customer interviews to validate priorities and gather feedback on shipped features • Define the competitive bar for each module based on direct comparison against incumbents in the space • Coordinate the free tier and Product Hunt launch plan, including which features to give away and how to upsell into paid • Track usage, success metrics, and engagement for shipped features and feed signal back into the roadmap • Collaborate with go-to-market on positioning, pricing, and bundle structure as we move from build to launch • Partner with the Oneleet Intelligence team on AI-powered features integrated into the bundles

• Build features end-to-end across backend (Go) and frontend (React/TypeScript) • Design and implement APIs that power dashboards, workflows, and reporting • Build UI components that present complex data clearly and drive user action • Map complex backend data to clear, actionable interfaces • Implement robust error handling and fallback behaviors for upstream service failures • Optimize end-to-end performance, including caching, pagination, and query design for high-volume data • Develop reusable patterns and components that scale across many areas of the platform • Work directly with customers and design partners to understand how features are used and iterate rapidly • Build monitoring and analytics to track feature usage, success rates, and user engagement • Collaborate with AppSec, backend, and design on how data flows from services through to the UI

• Develop and maintain backend services and APIs in Go • Design and optimize PostgreSQL schemas and queries for high-volume data • Build reliable orchestration and integration layers across internal and third-party systems • Implement metrics, distributed tracing, and observability across services • Collaborate with the Engineering team on improving the overall Developer Experience • Implement security best practices • Collaborate with frontend, fullstack, and the broader engineering team

• Own the integration, configuration, and output quality of security tooling that powers our platform • Tune outputs to maximize signal and minimize noise — decide what to surface, what to suppress, and what to enrich • Design rules, severity scoring, and triage flows that make findings actionable rather than overwhelming • Build the security judgment layer on top of underlying tooling — context-aware prioritization and exploitability reasoning • Partner with engineers on how findings are presented in the UI and how remediation flows work • Work with PM and design on roadmap priorities, providing the security expertise that drives what to build next • Review and shape architectural choices that affect security outcomes • Engage with customers directly to understand how they use the platform and what's blocking adoption • Benchmark our output quality against competitors and close gaps where they exist • Contribute back to the open source security tooling we depend on where it makes sense

• Build UI components and full pages in React/TypeScript across the platform • Extend and maintain our existing component library, ensuring consistency across the product • Implement complex triage, filtering, and workflow flows that handle high-volume data • Build data visualizations for dashboards, posture views, and reporting • Optimize frontend performance — list virtualization, smart pagination, responsive interactions on large datasets • Implement real-time updates where they matter • Partner with the Product Designer on mock-up reviews and on extending the component library • Work with fullstack and backend engineers to shape the APIs that power the UI • Build feedback loops and analytics that capture user interactions with new features • Work directly with customers and design partners to validate UX and iterate quickly

• Perform thorough internal reviews of client-uploaded evidence for compliance frameworks including SOC2, ISO27001, PCI, HIPAA, and GDPR • Conduct detailed quality assurance checks on individual controls to verify completeness, accuracy, and sufficiency prior to their audits with third-party auditing firms. • Execute comprehensive final QA reviews prior to clients engaging with an external auditor. • Identify gaps or weaknesses in evidence documentation and recommend improvements • Develop and maintain internal QA standards and review methodologies • Create guidance documents to help clients improve evidence quality • Collaborate with Security Program Engineers to address compliance gaps • Stay current on evolving compliance requirements across multiple frameworks to ensure our pre-audit preparation meets industry standards • Track audit readiness metrics and identify opportunities for process improvement • Provide expert feedback to our product team for compliance platform enhancements to better support pre-audit readiness

• Monitor and respond to customer questions across Slack shared channels and the support ticket queue • Resolve platform navigation, onboarding, billing, and pentest scheduling inquiries • Triage incoming requests and route escalations to the right internal team with full context documented • Send timely holding responses on escalations so customers always know what's happening • Log and tag all interactions accurately in our ticketing system (Pylon) • Identify recurring issues and contribute answers to the internal knowledge base • Collaborate with Security Program Managers, CS, and Engineering to resolve customer issues efficiently