Pasito (YC S22) - Security & IT Manager

Pasito is the AI workspace for employee benefits. We're looking for a Security & IT Manager to be the first dedicated owner of Pasito's security, IT, and compliance program. This is a high-visibility, high-impact senior role at the center of how Pasito runs, owning security, IT, and compliance end to end and serving as the connective tissue between engineering, HR, legal, sales, auditors, and customers.

Responsibilities

Direct Pasito's complete IT footprint, including domain management, Google Workspace, and platform portfolio; Oversee identity and permission governance: SSO, MFA, role-based controls, least-privilege architecture, and quarterly reviews; Lead team onboarding and offboarding procedures; Supervise organizational hardware via MDM solution, including enrollment, encryption, patching, endpoint protection, and inventory logging; Act as primary point of contact for internal IT issues and access requests; Maintain daily operations within Vanta, resolving failing tests and keeping audit trails current; Manage annual SOC 2 Type II audit execution and liaison with external auditors; Ensure continuous alignment with HIPAA regulations, managing executed BAAs and policy frameworks; Facilitate yearly penetration testing from partner selection through remediation; Conduct security evaluations of third-party vendors, managing DPAs, BAAs, and public records; Drive policy updates, risk reviews, security training, and trust resource hubs; Establish AI risk governance models and monitor third-party AI platform integration; Work with legal advisors to minimize security and compliance exposures; Maintain an active risk log and report security posture to leadership; Partner with software engineering teams to resolve vulnerabilities and audit findings; Lead operational security projects across departments; Direct the sales security response process, completing SIG, CAIQ, and custom questionnaires; Coordinate with HR on security-adjacent personnel operations, including background verifications and lifecycle checklists; Help foster a security-focused culture

Requirements

5+ years in security, IT, or GRC, including personally owning at least one full SOC 2 Type II cycle end to end; Hands-on experience running IT operations at a startup or growth-stage company: identity and access management, SSO, MDM, and SaaS administration; Experience operating a compliance automation platform in production (Vanta, Drata, or Secureframe); Enough technical depth to read a pen-test report, judge severity, and work credibly with engineers on remediation; Strong project-management skills; Excellent written and verbal English communication; Highly organized and deadline-driven; Based in Latin America, with strong overlap with U.S. business hours

Nice to have

CISA, CISSP, or ISO 27001 Lead Auditor certification; Healthcare, HIPAA, or benefits/insurance industry experience; Experience at an early- or growth-stage B2B SaaS company selling to enterprise or regulated buyers

Benefits

Strategic visibility: report to the VP of Engineering; Ownership: build and own the security, IT, and compliance function from the ground up; Growth: join at a pivotal stage and grow as the company scales; Competitive compensation: salary benchmarked to your market, paid in USD; Remote-first: work from anywhere in Latin America; Learning and development budget for certifications, courses, books, or conferences; Team offsites: in-person get-together every year