← All roles

Information Security Lead

Acquisition.com· Technology
Apply on company site
Remote$200k - $225kFull-timePosted 1w ago

About the role

Hands-on, founding information security role focused on operating ISO 27001 and ISO 42001, with ownership of security operations, incident readiness, risk management, and governance. Partners with platform, application, and AI engineering; reports to IT Systems Manager and collaborates with Legal and CTO.

Responsibilities

  • Operate the ISO 27001 and ISO 42001 management systems through continuous evidence collection, risk management, control testing, internal audits, management reviews, corrective actions, and surveillance audit preparation.
  • Build and run security operations across centralized logging, detection engineering, alert triage, incident response, security investigations, insider-risk escalation, tabletop exercises, and post-incident improvement.
  • Own the information security operating model, including policies, standards, risk acceptance, vulnerability governance, quarterly leadership reporting, security awareness, and the roadmap for maturing the function.
  • Lead identity, access, vendor, and data-protection controls through privileged-access governance, quarterly reviews, third-party assessment, classification, retention, deletion, and clear boundaries between operating companies.
  • Provide independent technical assurance across applications and cloud systems by reviewing architecture, application code, infrastructure-as-code, IAM policies, CI/CD workflows, and material vulnerabilities with the engineers who own remediation.
  • Establish security and governance controls for AI systems, including inventories, impact assessments, model and tool access, agent permissions, prompt-injection and data-exfiltration risks, audit trails, and tested shutdown mechanisms.

Qualifications

  • 7+ years of information security experience, including experience operating ISO 27001 programs.
  • Active CISSP certification, or eligibility and commitment to obtain it within six months of hire; ISO 42001 and CGRC experience preferred.
  • Experience remediating security incidents, including practical experience building logging, monitoring, and detection capabilities.
  • Ability to read and write code, ideally in Python and JavaScript/TypeScript, to identify potential attack paths, assess vulnerabilities, and recommend code-level fixes.
  • Proficiency with infrastructure-as-code tools such as Pulumi or Terraform, cloud IAM, and deployment workflows.
  • Knowledge of AI and agentic systems, with experience establishing practical security controls for their use.
  • Experience serving as a foundational or sole information security owner is highly preferred.

Skills

Required:ISO 27001CISSPIncident responseCode reading/writingInfrastructure as codeAI security
Nice to have:ISO 42001

Benefits

  • Flexible Unlimited Paid Time Off and Company-wide Holidays
  • Employer sponsored Medical, Dental, & Vision plans
  • $1,950 annual Employer HSA contribution
  • FSA options including dependent care
  • Employee assistance program and mental health resources
  • Employer match program for 401(k), eligible for both Traditional and Roth accounts
  • $1,200 annual wellness reimbursement through JOON
  • Access to a state of the art gym at HQ in Las Vegas (local/visiting team members)
Last updated Oct 14, 2026. Interested? Apply on the company site.

About Acquisition.com

We partner with $1M-$10M EBITDA Founders to help them grow great companies

Acquisition.com | We partner with $1M-$10M EBITDA Founders to help them grow great companies | Making Real World Business Education Available For Everyone

Business EducationScalingEntrepreneurshipBusiness Growth
Company profileWebsite

More open roles at Acquisition.com