About the role

At OrgChart, we operate a customer facing SaaS platform in AWS, while supporting an internal team of 50 employees. Identity, Security, and Operations are core to our success. Our GRC posture is well established, and compliance is a discipline, not an afterthought.

This role owns and oversees all of it. You will lead a two-person team — one covering corporate IT, one covering cloud platform — and you will personally own the compliance program that spans both. This is a hands-on, leadership role with responsibility in both defining the roadmap and executing against it.

What you'll own

Security compliance & certification

• Maintain and renew SOC 2 Type 2, ISO/IEC 27001:2022, and ISO/IEC 27018 — evidence collection, control operation, internal audit, management review, and auditor/certification body relationships.

• Own the risk register, policy set, vendor security reviews, access reviews, and the security questionnaire response process.

• Plan and execute our FedRAMP 20x/CR26 certification effort. You will recommend a target class, build the plan, and run it.

• Serve as the internal owner of security incident response process and the monitored security inbox.

Cloud platform

• Set the roadmap for our infrastructure platform (AWS, EKS, limited on-prem and multi-cloud) in support of the business’ growth targets

• Drive infrastructure-as-code coverage, centralized logging, centralized identity, and automated configuration management — both for operational maturity and in support of compliance requirements

• Grow the DevOps role into a Developer Experience function over time: CI/CD, build and deploy tooling, environment management, and developer feedback loops in partnership with EPD.

• Own uptime, capacity, disaster recovery, and the on-call model.

Corporate IT

• Set the roadmap for corporate IT: identity and access lifecycle, endpoint management, SaaS administration and rationalization

• Raise the floor from ticket-driven to policy-driven: automate provisioning, enforce device compliance, consolidate SSO, and make access reviews a byproduct of the system rather than a quarterly scramble.

• Own IT spend, vendor contracts, and renewals.

What we're looking for

Required

• 8+ years in infrastructure, cloud, or IT operations, including 3+ years managing people directly.

• Strong understanding of modern SaaS infrastructure patterns (scalability, security, reliability)

• Demonstrated ownership of at least one of SOC 2 Type 2 or ISO/IEC 27001 as the accountable party — not as a contributor to someone else's program.

• Comfort operating with a small team and a broad surface area. You have been the person who both wrote the roadmap and closed the ticket.

Strongly preferred

• Direct FedRAMP experience — Rev5 or 20x, as a CSP or as an assessor.

• Familiarity with OSCAL, KSI-based validation, or compliance-as-code tooling.

• Corporate IT leadership at a company between 50 and 250 people.

• Experience building a Developer Experience or Platform function from scratch.
  

We are committed to building a team that reflects a range of backgrounds and perspectives. If you meet most of the above and are energized by the rest, apply.