Company Description
International Outsourcing, Inc. (IOI) has been delivering innovative solutions for over 30 years, specializing in cloud-based services, data warehouses, business intelligence, artificial intelligence, and data analytics. With expertise in managing complex data, including financial and healthcare data, IOI combines cutting-edge tools with deep industry experience to provide comprehensive business solutions. Our portfolio includes solutions like cloud migration, data governance, and advanced data processing tools. At IOI, we prioritize long-term partnerships and work collaboratively to deliver tailored solutions that reduce risk, enhance efficiency, and enable business success. Join a team that thrives on innovation, trust, and a customer-first approach.
The role
We need one operator to be the entire security and compliance program within a startup mindset company. Strategy, audit, Azure controls, customer trust. (Yes, all of it.) You report to the founder.
You've collected 10+ years across GRC, cloud security engineering, security analyst, DevSecOps, and AppSec. You've worn most of these hats already. We need you wearing them all in one seat.
This is an operator role. The work is the job.
What you'll own
• Program strategy. Set the security posture. Write the roadmap. Decide what gets built now, what waits, and what we pay a vendor for.
• GRC and audit. Own policy, the risk register, vendor risk, customer security questionnaires, and RFP responses. Lead the company through HIPAA (Core and Essential to the role), SOC 2 Type II, FedRAMP Moderate, HITRUST, ISO 27001, NIST 800-53, StateRAMP, or privacy frameworks (e.g. GDPR, CCPA) work as the business demands it. You scope the audit, pick the assessor, design the controls, gather the evidence, defend the findings, and close the gaps.
• Azure security engineering. Configure and tune the actual controls. Entra ID, Conditional Access, PIM, Key Vault, Defender for Cloud, Defender XDR, Sentinel, Azure Policy, NSGs, Private Endpoints, Azure Firewall, Front Door / WAF, storage and SQL hardening, baseline configuration across subscriptions and management groups. You build it.
• AppSec and product security. Partner with engineering. Threat modeling, design reviews, secure coding guidance, SAST / DAST / SCA, secrets scanning, container and Kubernetes hardening, API security, CI/CD pipeline security. You coordinate external pen tests and drive remediation to closure.
• DevSecOps and automation. Codify security. Ansible, Terraform, Bicep, PowerShell. Automate evidence collection and posture monitoring so the program scales without headcount.
• Detection and response. Own logging, monitoring, alerting, and IR. Triage alerts, run investigations, lead the response, write the post-mortem, and feed lessons back into the controls. Maintain the IR plan and be the on-call security contact. (When something fires at 2am, you pick up.)
• Identity and access. SSO, MFA, lifecycle, least-privilege across SaaS and cloud. Run access reviews. Offboard cleanly.
• Vulnerability management. Endpoints, servers, cloud, containers, code dependencies. Prioritize, track, drive to closure.
• Awareness. Onboarding security education, phishing simulations, periodic training.
• Customer trust. Be the security face to customers and prospects. Handle security reviews, redline security terms in contracts (BAAs, DPAs, security addenda), write the trust-center content. Help close deals.
What we want in the person
• 10+ years across information security. Hands-on time in at least three of: GRC and audit, cloud security engineering, DevSecOps, application security, security operations, identity and access management.
• Has taken an organization through audit at least once. You've owned controls and evidence for three or more of: SOC 2, HIPAA, FedRAMP Moderate, HITRUST, ISO 27001, NIST 800-53 / CSF, PCI DSS, GDPR, StateRAMP.
• Deep, hands-on Microsoft Azure. You can harden a subscription from scratch, write Azure Policy, tune Defender for Cloud, and build Sentinel detections without help.
• PowerShell required. Python, Bash, or similar a plus. Working-level infrastructure-as-code (Terraform, Bicep, or ARM).
• Has secured SaaS, IaaS, and PaaS architectures: CI/CD pipelines, containers (Docker, Kubernetes), APIs, consumer-facing web apps.
• Working familiarity with at least one SIEM / XDR and one vulnerability management platform. Comfortable with SAST, DAST, SCA, and secrets-scanning tools.
• Demonstrated threat modeling and risk assessment skills.
• Has been the primary point of contact with external auditors and assessors, and the security voice in customer and prospect calls.
• Self-directed. Has stood up or materially grown a security program with limited resources.
Nice to have
• First or only security hire at a startup or small company.
• Regulated-industry background (healthcare, fintech, public sector).
• AWS or GCP alongside Azure.
• Enough software engineering chops (C#, Java, Python, Go) to read code and review pull requests.
• Has stood up an eGRC or compliance automation platform (Drata, Vanta, Anecdotes, AuditBoard, or similar).
• Has led incident response, including breach coordination with legal and outside counsel.
Certifications
One or more of the following, or equivalent demonstrated experience:
• Security breadth: CISSP, CISM.
• Audit and GRC: CISA, CRISC, HITRUST CCSFP.
• Cloud: Azure Security Engineer (AZ-500), Azure Solutions Architect, CCSP, CCSK.
• AppSec and DevSecOps: CSSLP, GWAPT, GCSA.
• IR and offensive: GCIH, GCIA, GPEN, OSCP, CEH.
How you work
• Communicates plainly with engineers, executives, auditors, and customers. In writing and in person.
• Pragmatic about controls. Knows when a heavyweight one is right, and when a lighter one will do.
• Comfortable being the only person in the function.
• Calm under audit pressure and incident pressure.
• Current on the Azure roadmap and the threat picture without being told.
• Builds trust with engineering and product.
- These are today's duties. The role will evolve as the company does.
