Head of Security and Compliance

Description

At Korbyt, we advocate for employees: the most valuable assets for any company. That’s what fuels our never-ending desire to help companies improve the way they communicate with the workforce. When a company can reach everyone, there is an opportunity to capture attention and instill action through the delivery of relevant content, data and information. And an engaged, informed workplace achieves business success. We began as RMG Networks 40 years ago, with a heritage in broadcasting content. Today, as Korbyt, our future is at the forefront of helping to transform the workplace experience.

At the heart of every company are great people. We are a diverse group of people, working as teams to support each other, our partners and customers. If you have passion and integrity, love what you do, and care about making a difference, then bring your talents to Korbyt and help us transform the workplace experience.

WHAT WE ARE LOOKING FOR

The Head of Security & Compliance owns Korbyt’s security and compliance program from end to end. This includes our SOC 2 audit cycle, customer security questionnaires and RFI responses, internal information security policies and controls, vendor risk management, and the external partners we use for technical security work.

This is a hands-on, execution-focused individual contributor role. You will personally run the compliance program, write the policies, collect the audit evidence, answer the questionnaires, and manage the auditors and vendors. While you'll have a cross-functional teams you can rely on for collaboration and information, you will be the primary person responsible for writing policies and gathering evidence. The right candidate gets energy from doing this work themselves and takes pride in being the person who gets security answers across the finish line.

Security is a direct factor in winning and keeping enterprise customers. This role exists to make security a competitive advantage for Korbyt: fast, credible responses to customer security reviews, a clean SOC 2 report, and internal practices that hold up under scrutiny.

Requirements

WHAT YOU’LL DO

SOC 2 & Compliance Ownership

Own the SOC 2 Type II audit cycle end to end: control design and operation, evidence collection, auditor relationship, remediation, and annual renewal.

Run our GRC platform as the system of record for controls, policies, and evidence, keeping it audit-ready year-round rather than scrambling at renewal time.

Maintain and advance compliance posture against frameworks relevant to our customers, including readiness work toward additional certifications as business needs dictate (e.g., ISO 27001).

Track regulatory and privacy requirements that apply to our business (GDPR, CCPA) and keep policies and practices aligned.

Customer Security Enablement

Own responses to customer security questionnaires, RFI/RFP security sections, audits, and due diligence requests, working directly with Sales and Sales Engineering.

Build and maintain a reusable library of approved security responses, documentation, and artifacts so customer reviews get faster over time.

Represent Korbyt on customer and prospect security review calls.

Identify security gaps that block enterprise deals and drive them to resolution with Engineering and IT.

Internal Security Policies, Procedures & Controls

Write, maintain, and continuously improve Korbyt’s information security policies, standards, and procedures.

Design and operate internal controls across access management, change management, vendor management, data handling, and employee lifecycle.

Run periodic access reviews, risk assessments, and internal audits, and maintain the risk register and remediation plans.

Report security and compliance posture to executive leadership with clear, practical metrics.

Security Operations & Incident Response

Run vulnerability management: track findings from scans and penetration tests, prioritize, and drive remediation with Engineering and IT.

Coordinate incident response: maintain the IR plan, lead investigations when issues arise, and run post-incident reviews and customer communications as needed.

Partner with Engineering to embed security requirements into the development lifecycle and review security implications of new products, technologies, and integrations.

Maintain business continuity and disaster recovery documentation and testing from a security perspective.

Vendor & Partner Management

Select and manage external security partners: penetration testing firms, auditors, and managed security or monitoring services where they make sense.

Run the third-party vendor risk program, including security reviews of new vendors and periodic reassessment of existing ones.

Security Awareness & Training

Run the company security awareness program, including onboarding training, annual refreshers, and phishing simulations.

Promote practical security accountability across all business functions.

WHAT YOU HAVE

6–10 years of hands-on security and compliance experience at a SaaS or technology company.

Direct, personal experience running a SOC 2 Type II audit cycle, including evidence collection and auditor management. You have done this work yourself, not just overseen it.

Experience owning customer security questionnaires, RFI/RFP security responses, and customer security reviews for enterprise buyers.

Working proficiency with a GRC platform such as Vanta, Drata, or Secureframe.

Strong working knowledge of cloud security (AWS and/or Azure), identity and access management, and vulnerability management.

Ability to write clear, audit-ready policies and procedures, and to explain security posture credibly to customers, auditors, and executives.

Experience coordinating incident response and working directly with engineering teams on remediation.

Comfort operating as a one-person security function: self-directed, organized, and accountable for outcomes without a team.

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or related field, or equivalent practical experience.

PREFERRED QUALIFICATIONS

Industry certifications such as CISSP, CISM, CCSP, CISA, or ISO 27001 Lead Implementer/Auditor.

Experience taking a company through ISO 27001 readiness or certification.

Experience at a PE-backed or high-growth SaaS company where security supported the sales process.

Familiarity with application security practices and secure SDLC.