Senior IT Security & Compliance Lead

Senior IT Security & Compliance Leads own security and compliance at Wordsmith end-to-end — setting the strategy for IT and infrastructure security, running our certification program across SOC 2, ISO 27001, and ISO 42001, embedding responsible-AI practices into how we build and ship product, and making sure privacy and regulatory obligations (GDPR and beyond) are handled properly as we grow.

Responsibilities

Own Wordsmith's multi-year IT security and compliance roadmap; Own security architecture across corporate IT and infrastructure — identity & access management, endpoint protection, and cloud/network security — and lead incident response; Own SOC 2 Type II, ISO 27001/27017/27018, and ISO 42001 end-to-end — policies, controls, audit evidence, and the audits themselves; Run AI governance program, including AI Impact Assessments and model/AI-vendor risk reviews; Own privacy operations end-to-end — GDPR and other regulatory obligations, DPIAs, RoPA maintenance, sub-processor management, and Data Subject Request fulfilment; Assess vendors and AI tools for security, privacy, and AI risk; Build the people, process, and tooling the function needs as it scales; Own risk and compliance reporting to leadership and board; Act as senior voice on security for enterprise deals; Build lean, automation-first tooling (e.g. Vanta) for evidence collection and ongoing compliance monitoring

Requirements

8-10+ years in security, IT, or compliance roles, including a track record of owning a security or compliance function end-to-end at a fast-growing SaaS or tech company; Proven experience building or scaling a security/compliance program from an early stage — ideally including time as the sole or founding owner of the function; Deep, hands-on expertise across SOC 2, the ISO 27000 series, and ideally ISO 42001; Strong grounding in core IT security fundamentals — identity & access management, endpoint/device security, and cloud or network infrastructure security; Practical, working knowledge of GDPR and related privacy regulation (ePrivacy, HIPAA, or similar); Experience presenting security posture, risk, and roadmap to executives, boards, or investors; Experience building and/or managing a team — or a clear point of view on how you'd grow one as the function scales; Comfortable owning budget and vendor decisions at a strategic level, not just executing against someone else's plan; A strong cross-functional operator and executive communicator, bridging Security, IT, Legal/Privacy, Engineering, and GTM

Nice to have

Prior experience as a Head of Security, Director of Security/IT, or similar senior/leadership title; Relevant certifications — e.g. CISSP/ISC2, CISM, AIGP, CIPP/E, CIPT, CCSK, or FIP; Experience in legal tech, AI, or another highly regulated SaaS environment; Experience designing AI risk or impact-assessment processes from scratch; Familiarity with tools such as Datagrail, MineOS, Whistic, or SafeBase

Benefits

Competitive compensation; benefits; meaningful equity