Founding Information Security Lead

You'll own Flodesk's security program end to end: the frameworks, controls, and governance that define our long-term security posture. Reporting to the COO/CPO, this is a hands-on, build-it-yourself role that drives SOC 2, ISO 27001 and CCPA auditing readiness, embedding security into how engineering ships product, and keeping day-to-day IT and vendor operations running. You'll write the policies, run point on audits, partner with engineering on the technical foundations — all while setting the strategic direction for where security goes next and representing it confidently, internally and externally.

Own Flodesk's security program: policies, controls, governance, and long-term maturity planning

Collaborate cross-functionally to build security into product, operational, and technology decisions

Maintain and update - privacy-related security practices across data handling, retention, and customer commitments

Lead SOC 2, ISO 27001 and CCPA readiness, including audits, evidence collection, and continuous compliance

Partner with engineering to integrate security into architecture, development workflows, and release processes, and to build and maintain security foundations across cloud infrastructure, applications, data, and internal systems

Evaluate, implement, and maintain security tooling and automation to scale the program

Own Security Incident Management end to end: process, technical capability, and cross-company engagement

Design, implement, and continuously improve controls

Track and report on security posture, program maturity, and compliance status

Defend Flodesk's SaaS platform and its customers by introducing protective mechanisms and security capabilities

Own the lifecycle of company hardware from procurement to retirement

Be the first point of contact for IT issues: hardware, software, network connectivity

Run new-hire setup (accounts, device provisioning) and secure access revocation for leavers. Manage domain registrations, DNS, and general IT housekeeping

Vet new tools before purchase, checking for SSO, 2FA, and integration capabilities

Maintain a central registry of approved software so the org stays on authorized tools

10+ years in information security, with a track record of building or maturing security programs

3+ years in an information security leadership role

Strong foundation in cloud security, identity governance, vulnerability management, and incident response

Proven experience aligning security and privacy practices with GDPR

Comfortable partnering directly with engineering on product security and secure development practices

Clear, confident communicator with technical and non-technical stakeholders alike

Startup DNA: a can-do attitude, flexibility, and the willingness to occasionally roll up your sleeves on the basics, given our startup mindset

Willing to travel on a semiannual basis

Experience securing SaaS products

Experience implementing SOC 2, ISO 27001/2, or similar security/compliance frameworks

Background in reliability, DevOps, or application architecture

Conversational (or better) Vietnamese

$120,000–$220,000 base salary, depending on your location and experience. We prefer to hire near our Menlo Park hub for in-person collaboration with the COO/CPO. Residents in Seattle & San Francisco Bay Area: $160,000–$220,000; all other locations $120,000–$180,000.

Fully paid health insurance for individual coverage

16 weeks paid parental leave for non-birthing parents; 22 weeks paid maternity leave for birthing parents

Unlimited flexible time off

401k match (US employees only)

$1,000 annual stipend for learning and development