Security Operations Lead, Freshpaint

• If you value lots of freedom and ownership in your work, interfacing with customers, and working on a product with high customer impact, then Freshpaint is your home
• 3+ years of experience in security operations, GRC, or compliance at a SaaS or cloud-based company
• Strong understanding of security frameworks and standards (SOC 2, HITRUST, ISO 27001, etc.)
• Experience managing audits and working directly with assessors and penetration testing vendors
• Familiarity with cloud infrastructure (AWS, GCP) and modern software development practices
• Excellent project management and cross-functional communication skills
• You’re organized, detail-oriented, and excited by the challenge of building scalable security programs in a fast-moving environment

Desirable

• Our team has deep analytics and growth experience, with all of us coming from high-growth companies like Heap, Pendo, Iterable, Quantum Metric, and Retool
• We’re looking for a Security Operations Lead to own and drive Freshpaint’s operational security initiatives
• This role will serve as the connective tissue between our engineering, compliance, and operations teams, helping us maintain and continuously improve our security posture
• You’ll manage day-to-day security operations and lead key security programs, including penetration testing, SOC 2 audits, and HITRUST R2 certification efforts
• You’ll also help scale our security processes as we grow, ensuring we stay proactive and compliant across frameworks
• You'll own and manage Freshpaint’s recurring security compliance programs, including SOC 2 Type II, HITRUST R2, and other certifications or audits as needed
• Coordinate and manage annual penetration tests and follow through on remediation activities
• Maintain and continuously improve Freshpaint’s security controls and documentation
• Partner with engineering and product teams to operationalize security best practices across systems, tools, and processes
• Support risk assessments, vendor security reviews, and internal audits
• Act as a key point of contact for external auditors, customers, and vendors on security-related matters
• Drive security awareness and education initiatives across the company