Cybersecurity Lead / Security Engineering & Compliance Lead

Overview

Hands-on Cybersecurity Lead to strengthen and oversee Irth's security program, acting as both a cybersecurity practitioner and policy leader across engineering, infrastructure, IT, GRC, and executive leadership.

What you'll do

• Own triage and prioritization of security findings from SAST tools, infrastructure security assessments, penetration tests, and newly disclosed CVEs, including risk and severity assessment, remediation priorities, and assigned ownership and deadlines.
• Partner with engineering and infrastructure teams to resolve vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning.
• Integrate security findings into engineering work management systems so every finding has an assigned owner, tracking ticket, and target remediation date.
• Report remediation progress, outstanding risks, and security trends to IT, engineering, and executive leadership, and provide appropriate vulnerability and remediation updates to customers.
• Lead security incident response from initial detection and investigation through containment, remediation, and post-incident review, and coordinate urgent vulnerability and CVE responses across technical teams.
• Establish and manage incident communications, including internal status updates, executive briefings, Customer Experience talking points, and accurate, timely customer-facing communications on potential exposure, remediation status, and detection activities.
• Maintain incident response runbooks and on-call escalation procedures, and conduct regular incident response tabletop exercises.
• Own cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.
• Establish and enforce identity and access management policies covering least-privilege access, role-based access and permissions, session duration and expiration, multi-factor authentication (MFA), privileged access management, and employee and contractor onboarding, transfers, and offboarding.
• Manage and strengthen identity controls across Microsoft Entra ID and AWS IAM, conduct regular access reviews for employees, contractors, and third-party vendors, and identify and remediate excessive permissions, inactive accounts, and access control gaps.
• Develop, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST Cybersecurity Framework (CSF) and ISO 27001.
• Own the technical security controls supporting SOC 2 Type II and ISO 27001 compliance, and partner with GRC teams on audit readiness, evidence collection, and remediation of control gaps.
• Monitor regulatory and industry requirements affecting critical infrastructure customers, including TSA pipeline security directives, NERC CIP-related customer security expectations, and applicable Canadian privacy legislation, and translate them into practical technical security controls.
• Lead technical responses to customer security questionnaires in partnership with GRC, and represent Irth's cybersecurity program during customer security reviews and calls.
• Manage third-party penetration testing engagements and security vendors, and support cybersecurity due diligence for acquisitions.

What you'll need

• 8+ years of experience in cybersecurity engineering or security operations.
• At least 3 years leading a security program or function.
• Hands-on cloud security experience across AWS and Microsoft Azure, including Identity and Access Management (IAM), cloud network security controls, security logging, monitoring, and audit trails, AWS CloudTrail and Microsoft Entra sign-in and audit logs, and cloud security posture management tools such as Wiz.
• Demonstrated experience owning vulnerability management end to end, including identifying, triaging, prioritizing, assigning, tracking, and driving remediation in partnership with engineering teams.
• Proven experience leading security incident response, including delivering clear, timely written communications to executive leadership and customers during high-pressure situations.
• Working knowledge of SOC 2 Type II, ISO 27001, and NIST Cybersecurity Framework (CSF), including experience serving as a key technical control owner through at least one SOC 2 Type II audit.
• Ability to review and interpret application code, infrastructure-as-code (IaC), and Linux and Windows server configurations to evaluate security risks and validate remediation approaches.
• Strong written and verbal communication skills, sound technical judgment, and the ability to distinguish between issues requiring immediate escalation and those that can be resolved through routine remediation.

Nice to have

• Experience supporting utilities, pipelines, energy providers, or other critical-infrastructure customers, including familiarity with TSA pipeline security directives or NERC CIP requirements.
• Familiarity with Canadian privacy requirements, including Quebec's Law 25.
• Experience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.
• Experience conducting cybersecurity due diligence or supporting security integration activities related to mergers and acquisitions.
• Relevant industry certifications, such as Certified Information Systems Security Professional (CISSP).

Details

• Location: United States; Canada.
• Role type: New position.
• Hybrid employees have access to an office in Columbus, Ohio.