Manager of Information Security

Clasp is a Forbes Fintech 50, SHRM-backed company tackling two hard problems at once: helping employers attract and retain talent in critical fields, and easing the student debt crisis. We're at a Series B inflection point, growing fast, with enterprise customers and partner banks who hold us to a high security bar. We're an AI-first company with a genuinely strong technical team and solid foundations already in place including a running SOC 2 program, a modern GCP infrastructure, a well-managed macOS/Windows fleet, and an engineering culture that ships. Your mission is to take ownership of the information security program, lead our Information Technology team, and pair with engineering leadership and AI Labs on the deep technical work.

Responsibilities

Run SOC 2 program end to end, own evolution of Information Security policies, own Vanta instance, run events such as business continuity drills, and represent information security in Risk + Compliance committee; Lead and collaborate with IT/TechOps team across corporate IT and security (laptop procurement, MDM, onboarding/offboarding, SaaS vendor management and hardening, incident response, data loss protection); Own third-party security reviews and be the front line for inbound customer and partner-bank security questionnaires; Configure SIEM, build alerting that gives real signal without noise, and manage vendor relationships for proactive visibility and risk reductions; Pair with technical leaders to advance cloud posture, IAM (JIT privilege escalation, group-based access), and platform hardening; Partner with engineering to advance secure SDLC, ensure dependency and vulnerability scanning is effective, CI/CD and pipelines are hardened, and new features have robust threat modeling; Work with CTO and AI Labs to run build vs buy analysis for agentic security work and ensure all other deployed agents operate securely

Requirements

CISSP certification; 5+ years on a security team; Startup experience — you've worked somewhere scrappy, not only at large/mega companies; Compliance in the room — you've been at a company that achieved SOC 2 or ISO 27001; A technical foundation — a semi-technical degree (Information Systems or similar) or a few years of hands-on technical work (scripting, web development, automation, data analysis, etc.); AI builder's instinct — comfortable scripting, prototyping, and using AI and modern tooling to solve problems efficiently; Strong communicator — credible and clear with customers, partner banks, auditors, and internal teams

Nice to have

Fintech, lending, or other regulated / high-trust experience; Hands-on GCP security depth (AWS experience also welcome); Stood up or owned a SOC 2 program from scratch; Experience fielding diligence from partner banks or enterprise customers

Benefits

Competitive cash and equity compensation; Health benefits (health, dental, & vision); Student loan repayment benefits; 401k matching; Commuter benefits; Flexible PTO policy; Opportunities to grow and perform in a fast-paced environment alongside a stellar team