Firmable's product depends on customer trust in how we handle their data. This role is the operational backbone of that trust: the controls you run are what let 1,000+ customers rely on Firmable with their data.
The Role
As our Security Engineer, you'll own the day-to-day execution of the security controls and policies that keep Firmable compliant against SOC 2 (all five TSC) and ISO 27001:2022. You'll report into the Security & Compliance team, fully remote and open globally. This is a hands-on operational role, not a paper-compliance one: you implement, monitor and continuously tighten the controls auditors and customers actually test against.
~90% hands-on execution: control implementation, continuous monitoring, evidence collection, vulnerability and access management.
~10% cross-functional: partnering with engineering on secure cloud config and shaping the program as it scales across frameworks.
What You'll Own
SOC 2 & ISO 27001 execution: implement and maintain controls across infrastructure, applications and internal systems; close gaps as they're identified
Security policy enforcement: put information security policy into daily practice across engineering and business teams, covering access control, data classification, incident response, vendor risk and change management
Continuous control monitoring: recurring access reviews, log reviews, vulnerability scans and patch cadence checks; organise evidence ahead of audits
Vulnerability management: triage scanner findings, coordinate remediation with engineering, verify closure
Identity & access management: onboarding/offboarding, least-privilege and MFA enforcement, periodic access recertification
Monitoring & incident response: watch security alerts and logs, triage and escalate per the incident response plan
Risk & vendor management: maintain the risk register and third-party risk assessments, track remediation to closure
Audit readiness: prepare evidence for annual assessments and respond to customer security questionnaires
Security awareness: run employee training and phishing simulations
Secure cloud configuration: partner with engineering on least-privilege IAM, encryption at rest and in transit, and secrets management (AWS)
What We're Looking For
Must haves
2–5 years in security engineering, cloud security or infrastructure security, ideally with direct SOC 2 or ISO 27001 exposure
Working knowledge of the SOC 2 Trust Services Criteria and how technical controls map to them
Hands-on cloud security fundamentals (AWS preferred): IAM, logging/monitoring, vulnerability scanning
Comfortable executing policy day to day (access reviews, evidence collection, remediation tracking), not just writing it
Clear written communication and comfortable working async across time zones with a distributed team
Highly valued
Familiarity with GRC automation platforms (Vanta, Drata or similar)
Relevant certification (Security+, CySA+, ISO 27001 Lead Implementer, or progress toward CISA/CISSP)
The Environment
Fully remote, open globally, working closely with a distributed Security and Engineering team across time zones. Real ownership over controls that directly protect customer trust, not a box-ticking exercise. Fast-moving, AI-native product team.
Why This Role
Real ownership: the controls you run directly protect the trust 1,000+ customers place in 's data
Multi-framework exposure from day one: a live SOC 2 and ISO 27001 program, not a single-framework box-tick
Competitive compensation and flexible hours in a fast-moving, AI-native product team
Originally posted on