About the role

You'll own Flodesk's security program end to end: the frameworks, controls, and governance that define our long-term security posture. Reporting to the COO/CPO, this is a hands-on, build-it-yourself role that drives SOC 2, ISO 27001 and CCPA auditing readiness, embedding security into how engineering ships product, and keeping day-to-day IT and vendor operations running. You'll write the policies, run point on audits, partner with engineering on the technical foundations — all while setting the strategic direction for where security goes next and representing it confidently, internally and externally.

What you'll do:

Security program ownership [40%]

• Own Flodesk's security program: policies, controls, governance, and long-term maturity planning
• Collaborate cross-functionally to build security into product, operational, and technology decisions
• Maintain and update - privacy-related security practices across data handling, retention, and customer commitments
• Lead SOC 2, ISO 27001 and CCPA readiness, including audits, evidence collection, and continuous compliance

Security implementation & compliance support [40%]

• Partner with engineering to integrate security into architecture, development workflows, and release processes, and to build and maintain security foundations across cloud infrastructure, applications, data, and internal systems
• Evaluate, implement, and maintain security tooling and automation to scale the program
• Own Security Incident Management end to end: process, technical capability, and cross-company engagement
• Design, implement, and continuously improve controls