• Own and evolve the GRC program in partnership with Legal and our CCO • Lead all efforts to achieve and maintain critical compliance certifications (SOC 2, potentially ISO 27001) • Manage external SOC2 audits and coordinate with third-party auditors (currently 4-6 week intensive periods annually) • Conduct quarterly user access reviews and maintain comprehensive access control documentation • Develop, maintain, and enforce clear, practical security policies across all departments • Work cross-functionally with IT and HR to ensure consistent policy adherence • Monitor compliance with laptop MDM requirements, 2FA, policy attestations, and security training • Develop and execute a comprehensive information security roadmap aligned with business objectives • Lead the organization's migration to a Zero Trust security approach • Select, implement, and manage endpoint detection and response (EDR) solutions • Oversee relationship with our managed IT service provider • Conduct vendor security reviews, risk assessments, and ongoing monitoring • Develop and execute security awareness training programs for all employees