Skip to content
    Open rolePosted 12 October 2026

    Virtual Chief Information Security Officer (vCISO)

    We are seeking a Virtual Chief Information Security Officer (vCISO) to embed within our engineering operations under a fractional staff augmentation model. You will serve as the executive security leader, bridging the gap between technical execution and enterprise compliance requirements. You will not be responsible for hands-on keyboard infrastructure changes; instead, you will govern the security strategy, maintain continuous audit readiness, and act as the primary liaison for enterprise security inquiries.

    • Work arrangement: Fully remote

    About the role

    Key Responsibilities

    Governance, Risk, and Compliance (GRC)

    • Assume primary ownership of automated compliance platforms, ensuring continuous alignment with SOC 2 Type II, ISO 27001, and PCI DSS frameworks.

    • Develop, formally approve, and maintain essential security policies (e.g., Incident Response, Access Control, Disaster Recovery) tailored to operational realities.

    • Conduct periodic risk assessments and translate regulatory requirements into actionable technical mandates for the cloud architecture and engineering teams.

    Enterprise Liaison & Vendor Management

    • Serve as the executive face of security, participating in technical leadership meetings with enterprise clients, stakeholders, and external auditors.

    • Complete inbound third-party risk management (TPRM) assessments and security questionnaires required by enterprise partners.

    • Review and enforce Data Processing Agreements (DPAs) and vendor security standards for any third-party tools integrated into the platform.

    Strategic Security Oversight

    • Provide strategic oversight for the remediation of legacy technical debt, prioritizing high-risk vulnerabilities (e.g., exposed credentials, unencrypted data) for the development team to execute.

    • Design and enforce secure software development lifecycle (SDLC) guardrails, ensuring automated security testing is effectively integrated into CI/CD pipelines.

    • Quantify cyber risk in business terms to justify necessary infrastructure investments and resource allocation to executive leadership.

    Requirements

    Required Qualifications

    • Experience: 8+ years in cybersecurity leadership, GRC management, or vCISO consulting roles.

    • Framework Expertise: Deep practical knowledge of SOC 2 Type II, ISO 27001, PCI DSS, and privacy regulations (GDPR/US Privacy Patchwork).

    • Certifications: Active CISSP, CISM, CRISC, or CISA certification.

    • Communication: Exceptional executive communication skills with demonstrated success navigating client audits and vendor risk reviews.

    How it works for you

    1. Apply once

      Pick an open role or send a general application. Your CV is enough to start.

    2. Record your interviews

      Answer questions on camera when it suits you: first about how you work, then on your stack, with a short timed test.

    3. A short live call

      Once your interviews pass, we meet you on a quick video call.

    4. Matched to client work

      We put you forward for every role that fits, not only the one you applied to, and tell you when there is no current match.

    How we handle your data: privacy policy

    View all positions
    Talent poolApply to the talent networkNo specific opening fits? Submit a general application. Our experts review each profile and contact you if relevant work becomes available.