Senior Information Security Engineer

Who Are We: We are COMPLY.  For compliance people. 
COMPLY is the leading global provider of comprehensive regulatory compliance software and solutions for the financial services sector. Our OneCOMPLY™ platform provides an all-in-one approach to address firm and employee compliance requirements through a configurable and scalable software-as-a-service (SaaS) platform coupled with expert consulting services. COMPLY serves thousands of financial services clients including Broker Dealers, Investment Banks, Private Funds, RIAs, and Wealth Managers who rely on COMPLY to power their compliance programs. 
To learn more about COMPLY, visit COMPLY.com

COMPLY is seeking a Senior Information Security Engineer with 7–10 years of combined IT and cybersecurity experience to help protect our organization’s systems and data. The ideal candidate has hands-on experience with securing modern IT, networking, and cloud infrastructure, and implementing controls aligned with frameworks such as SOC 2, ISO 27001, regulatory, and privacy requirements (e.g., GDPR, CCPA, EU DORA.) They are skilled in vulnerability management, SIEM administration, incident response, continuous security monitoring, and supporting audit compliance activities. This role will be pivotal in strengthening our security posture and ensuring compliance with industry standards. The individual must be solutions oriented and a self-starter that can work autonomously in a fully remote environment.

Responsibilities:

• Design, implement, and maintain security controls and policies to ensure compliance with SOC 2 and ISO 27001 standards. 
• Developing and updating security procedures, access controls, and monitoring mechanisms in line with these frameworks’ requirements for delegation. 
• Lead the organization’s vulnerability management program, including regular vulnerability scanning, assessment, and remediation efforts with Rapid7 InsightVM. Track and report on vulnerability status and trends monthly and drive continuous improvement in reducing risk exposure.
• Manage, configure, tune, optimize, and develop reports using the company’s Security Information and Event Management (SIEM) system Rapid7 InsightIDR.
• Investigate suspected security events and ensure that threats are detected, analyzed, and escalated in a timely manner. Coordinate with Infrastructure Operations and our 24/7/365 SOC vendor to resolve security incidents.
• Deploy and maintain detection tools like SentinelOne, Defender for Cloud/Endpoint, AWS GuardDuty, AlertLogic WAF, and cloud security monitoring that provide real-time visibility into security events. 
• Establish processes to review logs and alerts, watch for anomalous behavior or indicators of compromise, and take proactive action when issues arise. 
• Manage and administer the organization’s email spam filter, Mimecast, to include developing email filters and executing quarterly phishing exercises.
• Coordinate with external auditors to support security audits, assessments, and certifications such as SOC 1, SOC 2, and ISO 27001. 
• Gather evidence of control effectiveness, maintain documentation (policies, procedures, risk assessments, etc.), and remediate any findings or non-conformities identified during audits. Pursue methods to automate artifact collection for annual audits.
• Lead routine internal audits to ensure ongoing compliance with security policies and standards, and drive improvements based on observations.
• Develop and refine security policies, standards, exercises, and guidelines in collaboration with the CTO senior leadership team. 
• Ensure that policies address compliance requirements (e.g., access management, data protection, incident response) and are updated regularly. 
• Contribute to security awareness training efforts and phishing exercises and educate employees on cybersecurity best practices.
• As a senior member of the security team, be prepared to lead out incident response activities, determine root cause, and impact to COMPLY. 
• Tune security tools for better incident detection and participating in post-incident reviews to implement lessons learned.
• Collaborate with Infrastructure, Product, and Engineering teams to ensure security is embedded in development, IT infrastructure, and new projects. 
• Advise and assist in implementing system configurations, conducting security design reviews, and recommending enhancements to meet security best practices in cloud-based environments (AWS, Azure.)
• Support due diligence requests from customers to include responding to questionnaires, engaging with customers via phone or email on an as-needed basis, supporting assessments, and building/maintaining COMPLY’s Trust Center.

Qualifications:

• 7–10 years of combined expe