• Assess customer’s Falcon environment and ensure alignment with Falcon Complete standards. • Provide Falcon Complete customers with recommendations that align to improved security. • Create and recommend remediation for components of CrowdStrike products that may lead to improved security posture. • Contact customers directly upon identification of misalignment with Falcon Complete standards. • Document, update, and resolve all customer related issues in accordance with established procedures and SLAs. • Develop and provide customers with service reports and stats as requested. • Partner with internal teams to ensure customer satisfaction. • Liaise with support team to help troubleshoot and coordinate efforts to resolve technical issues.

• Assess customer’s Falcon environment and ensure alignment with Falcon Complete standards. • Provide Falcon Complete customers with recommendations that align to improved security. • Create and recommend remediation for components of CrowdStrike products that may lead to improved security posture. • Contact customers directly upon identification of misalignment with Falcon Complete standards. • Document, update, and resolve all customer related issues in accordance with established procedures and SLAs. • Develop and provide customers with service reports and stats as requested. • Partner with internal teams to ensure customer satisfaction. • Liaise with support team to help troubleshoot and coordinate efforts to resolve technical issues.

• Develop and execute the enterprise information security vision, strategy, and multi-year roadmap. • Serve as a trusted advisor to executive leadership and the Board on cybersecurity risks, trends, and investments. • Establish security objectives, metrics, and reporting mechanisms aligned with business priorities. • Drive a security culture across the organization that enables innovation while maintaining appropriate risk controls, including effectively communicating risks and changes in the risk landscape to leadership, the Board, and key stakeholders in clear, business-relevant terms. • Own the enterprise information security risk management program, including formal risk assessments, risk registers, and risk treatment plans. • Ensure compliance with applicable frameworks and regulations, including SOC 2, ISO 27001, HIPAA, HITRUST, PCI DSS, GDPR, and CCPA. • Oversee security audits, risk assessments, policy development, and remediation initiatives. • Manage the Business Associate Agreement (BAA) program across the customer and vendor ecosystem. • Maintain and test the enterprise Incident Response and Business Continuity programs. • Drive continuous improvement of security controls and risk management practices. • Oversee security operations, threat detection, vulnerability management, and incident response functions. • Own the security operations center (SOC) function, including SIEM strategy, threat intelligence, and endpoint detection and response. • Lead the organization's response to security incidents, including executive communication, regulatory notification obligations, and post-incident review. • Direct penetration testing, security assessments, and resilience exercises. • Partner with Engineering and Product leadership to embed security throughout the software development lifecycle (SDLC), including threat modeling, secure code review, and automated security testing. • Provide strategic direction for the design and implementation of secure enterprise and cloud infrastructure, ensuring security architecture principles are embedded in platform design, data flows, and technology decisions across the organization. • Provide security architecture review and guidance for new products, features, and third-party integrations. • Oversee vulnerability management, penetration testing, and remediation programs across the platform and infrastructure. • Build, mentor, and develop high-performing security teams. • Manage security budgets, technology investments, and vendor relationships. • Lead third-party risk management and vendor security assessment programs. • Demonstrated ability to work closely with leadership across the organization, including Engineering, Legal, Privacy, Product, Sales, IT, HR, and others, serving as a trusted partner who enables the business rather than a barrier to it. • Serve as the executive point of contact for cyber insurance underwriters, external auditors, and regulatory examiners.

Role Description UP.Labs is a venture studio that builds and launches vertical AI enterprise SaaS companies with corporate partners in transportation, mobility, logistics, and industrial markets. We are hiring a Senior Security Controls & Compliance Engineer on a 6+ month contract to build, implement, and operate the security control foundation across multiple venture applications. This is a hands-on security execution role. We are not looking for someone who documents gaps, manages a compliance tool, and routes work to engineering. We need an operator who can understand enterprise customer security requirements, identify the controls required, implement or configure those controls directly, and verify they are operating effectively. You will prepare our venture applications for SOC 2 readiness while supporting enterprise customer data, information security, and TPRM requirements. Because our ventures are built alongside large corporate partners, the security bar is set by real enterprise buyers from day one, not by an internal checklist. The goal is a repeatable security baseline that each venture application can inherit, operate against, and carry forward as it matures or spins out into an independent company. What You'll Own - Build, implement, and operate security and compliance controls across multiple venture applications and supporting systems. - Translate enterprise customer security, data handling, and TPRM requirements into practical technical controls, operational workflows, evidence requirements, and remediation plans. - Create a reusable security control baseline that can be applied across current and future venture applications. - Select, configure, and operate a compliance automation platform (evaluating options such as Vanta, Drata, or Secureframe), including evidence integrations across cloud, GitHub, identity providers, ticketing, device management, and productivity tools. - Implement identity and access controls: SSO, MFA, role-based access, least privilege, access review workflows, and offboarding evidence. - Implement secure SDLC controls: branch protection, required code reviews, code scanning, dependency scanning, secret scanning, vulnerability management, and release/change management evidence. - Implement cloud security controls: IAM policies, encryption settings, logging, monitoring, backups, network restrictions, and security alerting. - Implement operational security workflows: vendor review, risk review, change management, policy attestation, incident response evidence, exception tracking, and recurring control reviews. - Maintain a centralized control library mapped to SOC 2 Trust Services Criteria, customer-specific requirements, and relevant frameworks (ISO 27001, NIST CSF, CIS Controls). - Support SOC 2 readiness end to end: control mapping, evidence requirements, gap tracking, audit prep, and control verification. - Identify launch-blocking security gaps and close them directly where possible. - Partner with product engineering only where application-specific code, architecture, or deeper infrastructure changes are required, writing clear technical requirements and acceptance criteria for that work. - Support customer security questionnaires, audits, evidence requests, and enterprise security reviews with accurate technical detail. - Track control gaps, remediation status, launch blockers, and compliance risk for leadership. - Produce a repeatable security implementation playbook that future ventures can inherit, and support the handoff of a venture's security posture when it spins out. What Success Looks Like - Enterprise customer requirements are translated into implemented controls, not just documented gaps. - Each venture application has a working security baseline across identity, cloud, source control, CI/CD, logging, monitoring, evidence, and operational processes. - SOC 2 readiness is actively tracked with clear control ownership, evidence collection, and operating cadence. - Compliance tooling is selected, configured, and producing useful evidence across the required systems. - Engineering teams are engaged only when product-specific implementation is required, not overloaded with generic security tasks. - Security launch blockers are identified early, prioritized clearly, and remediated quickly. - Customer security reviews, audits, and questionnaires are handled with accurate technical detail and supporting evidence. - Leadership has clear visibility into control maturity, launch risk, audit readiness, and open remediation items. - A reusable security control baseline and playbook exists that can be applied to new ventures and carried forward as they spin out. Qualifications - 7+ years in security engineering, cloud security, DevSecOps, security operations, security compliance, or GRC, including hands-on control implementation in cloud/SaaS environments. - At least one full SOC 2 readiness-through-audit cycle owned or driven end to end. - Demonstrated ability to configure and operate security and compliance systems directly, not just document requirements. - Strong command of security controls, audit evidence, policy requirements, control testing, and control operation. - Proven experience translating enterprise customer security requirements into practical technical controls. - Hands-on experience with identity and access controls (SSO, MFA, RBAC, least privilege, access reviews, offboarding). - Hands-on experience with secure SDLC controls (source control permissions, code review, branch protection, vulnerability management, dependency and secret scanning, change management evidence). - Hands-on experience with cloud security controls (IAM, encryption, logging, monitoring, backups, network restrictions, alerting). - Experience standing up and operating a compliance automation / GRC platform (e.g., Vanta, Drata, Secureframe) from scratch. - Familiarity with our core stack: GitHub, Jira or Linear, Okta, Google Workspace, Slack, and a major cloud provider (AWS, Azure, or GCP). - Strong written communication for policies, procedures, audit documentation, technical requirements, and customer-facing security responses. - Ability to operate independently in an ambiguous, fast-moving venture environment and deliver on a compressed timeline. Preferred Qualifications - Experience supporting enterprise customers with strict security, data handling, or TPRM requirements. - Experience in venture-backed startups, enterprise SaaS, or venture studio environments. - Experience carving a company's security posture out of a parent or shared-services environment during a spin-out or standalone build. - Familiarity with SOC 2 Trust Services Criteria, ISO 27001, NIST CSF, or CIS Controls. - Experience with GitHub security features, CI/CD security controls, vulnerability management tools, and cloud security monitoring. - Relevant certifications: CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer, AWS Security Specialty, or Security+.