Reflection Sciences, Inc.

• Review and harden our Statement of Applicability + evidence package (ISO 27001/NIST-mapped) responding to an enterprise customer's Information Security Addendum • Sign the risk assessment and SoA as the named security officer; be the security contact enterprise vendor-risk teams can call • Sit on 2–3 customer security-diligence calls alongside the CEO • Validate what we attest against reality with the CTO • Advise on a security-exception / compensating-controls request and, if required, scope a right-sized SOC 2 Type I path • Scope and manage our first external penetration test and own findings triage with the CTO • Quarterly review of the compliance-calendar output (access reviews, risk-assessment refresh, training, phishing simulations, BC/DR and restore tests) • Annual re-attestation support; named contact for customer audits under contractual audit rights • Review our breach-notification runbook and advise if an incident triggers it

• Full ownership of Meta Ads and Google Ads accounts (strategy + execution + optimization) • Managing an aggregate ad budget of $10,000–$20,000/month • Building and maintaining campaign structure across: B2B lead gen (qualified Calendly calls) B2C subscription acquisition (GO consumer signups) • Writing and iterating all ad copy (hooks, primary text, headlines, descriptions) • Creating clear, actionable creative briefs and requesting photo/video assets from our internal team (your job is direction + testing plan; our team produces the content) • Making light landing page / website change requests (copy + layout suggestions) to improve conversion rates • Owning attribution and measurement Pixel + CAPI / conversion tracking health Event taxonomy / UTMs / conversion definitions • Troubleshooting gaps and ensuring reporting matches reality • Weekly performance reporting including CAC reporting and key funnel metrics • Weekly meeting with the CEO • Async day-to-day communication in Slack