Empirical - Fractional CISO

• Overview
• Application

IMPORTANT: At the moment we are only considering candidates located in Latin America. Please do not apply if you are not located in Latin America.

• About Empirical
• Empirical empowers early and growth stage tech companies to create the right products in the right way by providing two pivotal services:

Product & Technology Leadership: Our clients entrust critical decisions to our network of top-tier US-based CTOs and CPOs. We provide fractional, project, or advisory based support, combining highly experienced talent with a flexible approach.

Product Development Teams: We provide our clients with high performing, senior product development talent through a scalable staff augmentation model and ongoing support. We focus on Latin America to find exceptional talent, with time zone and cultural compatibility.

We are proud to be a people first company, where we prioritize building meaningful, long lasting human connections with clients and team members alike, while embracing diversity and uniqueness. With this foundation and our focus on talent, we help create great products that people love.

Our values

Care about people first

Strive to add value always

Lead with integrity

Have fun every step of the way

• The Opportunity
• This role is with Empirical itself. We're a fully remote team of around 40–50 software engineers across Latin America, with co-founders based in San Diego. Our clients, including healthcare companies and marketing agencies serving financial-industry accounts, now contractually require written security policies consistent with FTC guidance, 24-hour breach notification, approved-subprocessor controls, cyber insurance and annual audits.

We're looking for a fractional security leader to build and maintain our security program. Our environment is lean: Google Workspace for SSO and identity, SaaS tools, GitHub and Anthropic Enterprise. We host almost no infrastructure of our own, since our engineers typically work inside client environments. Some company-issued Macs are managed with MDM, and our policies are currently informal.

The engagement starts with a gap assessment and a thin layer of policies and Workspace hardening, then grows toward SOC 2 as the business justifies it. We need someone who can phase the work sensibly rather than roll out a full enterprise program on day one.

What you'll do

Run an initial security gap assessment across our people, tools and processes

Draft and maintain security policies, incident response plans and risk assessments

Harden our Google Workspace environment against the CIS benchmark

Strengthen MFA and identity management, MDM and remote wipe, centralized logging and vulnerability management

Prepare the company for client audits and vendor security questionnaires

Review client MSA and security addendum language, including liability caps, breach terms and subprocessor clauses

Define secure-coding and DevSecOps practices for engineers working in client repositories

Build a phased roadmap toward SOC 2 that fits our size and budget

• Your qualifications and experience
• Must haves

Experience helping US software development or IT services companies, such as staff augmentation firms, dev shops or consultancies, not only SaaS or enterprise companies

Track record standing up security programs from near-zero and preparing small companies (20–100 people) for client audits and vendor questionnaires

Hands-on experience with SOC 2 Type 2, NIST CSF and CIS Controls, and the judgment to know when a lighter framework is the right starting point

Experience with Google Workspace hardening (CIS benchmark), MDM/remote wipe, MFA/identity management, centralized logging/SIEM and vulnerability management

Ability to draft policies, incident response plans and risk assessments, and to review client MSA and security addendum language

Comfortable with DevSecOps and secure-coding practices for engineers working in client repositories

CISSP, CISM or equivalent certification

Advanced English required.

Familiarity with AI tools.

Nice-to-haves

Experience with remote, distributed or LATAM-based teams

Familiarity with HIPAA/healthcare and financial-services client requirements

Experience working alongside fractional CTOs

What we expect from you

100% alignment with our core values!

Ability to take ownership of projects from start to finish

Strong collaboration and communication skills

Attention to detail and a passion for delivering high-quality work

What we offer

Remote/flexible work

Highly competitive compensation in US dollars

Opportunities for personal and professional development; mentorship, coaching and training as needed

Ongoing, fractional dedication

The opportunity to be part of an amazing, multicultural community of tech experts

Why work with us?

We pride ourselves on our core values and have proven that putting people first creates a thriving and collaborative work environment.

We seek to accommodate and balance individual needs with client needs, understanding each one of us is unique.

We offer benefits such as remote/flexible work, selective paid training, mentorship programs, referral programs and more.

We are selective in the projects we take on to ensure our teams are engaged in challenging, meaningful, enjoyable opportunities that will provoke creativity, innovation and growth!