Security and Compliance Manager

Role: Manager, IT Security and Compliance

Type: 6+ months contract

Location: NYC, NY - 2 days hybrid

Check you match the skill requirements for this role, as well as associated experience, then apply with your CV below.

Position Overview

We are seeking a Manager, Security & Compliance to help strengthen the organization's cybersecurity, technology risk, and compliance programs. This role will be responsible for evaluating security risks, designing practical controls, supporting audit and compliance activities, and partnering with business and technology teams to ensure new systems, integrations, and processes are implemented securely.

This is a highly visible, cross-functional role suited for someone who can operate effectively in a fast-moving, lean environment. The successful candidate will work directly with application owners, business leaders, IT, legal, and technology teams to translate security and compliance expectations into clear, practical requirements without unnecessarily slowing down the business.

This role reports to the Director of Cyber Security & Compliance.

What You'll Do

• Lead security and compliance reviews for new and existing technologies, including SaaS platforms, applications, APIs, cloud services, integrations, automation tools, and AI-enabled solutions.
• Assess risk across business and technology initiatives, with a focus on data protection, access controls, vendor risk, logging, auditability, and secure configuration.
• Define and implement practical security controls that align with business needs, regulatory expectations, internal policies, and audit requirements.
• Partner with application owners and business stakeholders to identify security and compliance requirements early in the project lifecycle.
• Conduct security and architecture reviews for applications, APIs, integrations, data flows, and third-party platforms.
• Support compliance activities, including evidence collection, control documentation, risk remediation tracking, user access reviews, and audit response.
• Strengthen application and network security posture by contributing to secure design, vulnerability management, control improvements, and remediation planning.
• Review third-party technology solutions and support vendor due diligence from a security and compliance perspective.
• Establish and maintain guardrails for technology use, including acceptable use, data handling, access management, logging, monitoring, and approval standards.
• Support incident response and investigations involving applications, integrations, vendor platforms, data exposure, or control failures.
• Track risks, issues, remediation plans, and control maturity, and provide clear reporting to leadership.
• Help develop lightweight, scalable processes for reviewing and approving new technologies in a growing organization.
• Stay current on emerging threats, compliance expectations, cybersecurity frameworks, and industry best practices.
• Implement and test CI/CD and secure development controls within internally developed applications.

What You Bring

• Bachelor's degree in Computer Science, Information Security, Information Systems, or a related field.
• 7+ years of experience in cybersecurity, technology risk, IT audit, compliance, application security, or network security.
• Strong understanding of security and compliance fundamentals, including access management, authentication, authorization, data protection, logging, vulnerability management, and secure configuration.
• Experience reviewing applications, APIs, SaaS platforms, cloud environments, or integration-heavy technology ecosystems.
• Familiarity with application security concepts, including OWASP risks, secure SDLC practices, API security, and data protection requirements.
• Solid grounding in network security concepts and modern enterprise architectures.
• Experience designing, documenting, or testing security controls in SaaS, cloud, or API-driven environments.
• Ability to perform risk assessments and translate findings into practical, business-friendly recommendations.
• Experience supporting audits, compliance programs, or security governance activities.
• Strong communication skills and the ability to influence decisions across technical and non-technical teams.
• Comfortable operating in a lean, fast-paced environment with evolving priorities.

Nice to Have

• Familiarity with frameworks such as NIST CSF, CIS Controls, SOC 2, ISO 27001, or similar control frameworks.
• Experience supporting SOC 2, internal audit, external audit, or regulatory compliance programs.
• Experience with third-party risk management, user access reviews, policy governance, or control testing.
• Exposure to AI governance, emerging technology risk, or responsible AI initiatives.
• Experience in a mid-sized or growth-stage company environment. xhyhwjd
• Industry certifications such as CISSP, CISA, CCSP, GIAC, Security+, or similar.