Security Program Manager

What you will do: Own GRC Tool (Vanta): failing controls, evidence, and following up with the people who actually fix things Be the primary contact for our SOC 2 auditor and the ISO 27001 certification body Maintain SOC 2 Type II compliance through audits (PBC lists, walkthroughs, findings response) Run vendor security reviews on a weekly cadence Answer customer security questionnaires; stand up and maintain a current Trust Center Own abuse / acceptable-use intake and enforcement process Own spam reporting and email blocking Keep HIPAA, GDPR, and EU AI Act documents accurate Finish our ISO 27001 ISMS package: procedures, Statement of Applicability, internal audit, management review Build a FedRAMP readiness folder (inventory, authorization boundary, control map from SOC 2/ISO to NIST 800-53). We start a 3PAO only if a named federal deal requires it Use AI to draft, research, and speed up routine GRC work; verify accuracy before any output is treated as auditable proof Own employee security onboarding and offboarding (accounts and access, Vanta tasks, MDM, background-check evidence, timely leaver cutoff) What you need You write clearly. This job is evidence, auditor email, and customer questionnaires You can own a queue: pick up work, follow up professionally, close the loop, and see items through to completion You work AI-first: you use automation to move faster, and you personally review the output before it becomes audit evidence or customer-facing material You are willing to be the named contact for auditors and customers once trained Background in security, compliance, IT, operations, or similar process work helps. Direct SOC 2 / Vanta / vendor-review experience is not required.

Nice to haveS: OC 2, ISO 27001, HIPAA, or GDPR exposure in any role Vanta, Drata, Secureframe, Sprinto, or another GRC tool Vendor security reviews or customer security questionnaires Policies or procedures you wrote that someone else actually used NIST 800-53 or FedRAMP as a contributor Cloud, IaaS, GPU cloud, or colocation familiarity Trust-and-safety, AUP, or abuse handling We are a lean, ambitious team operating in one of the most important technology markets in the world. If you want ownership, pace, and the opportunity to do career-defining work alongside practical, high-agency teammates, Massed Compute is a great place to build. Market competitive compensation We are a remote-first company. You’ll get a stipend to dial in your setup and additional opportunities to connect with your peers during periodic in person team gatherings Flexible PTO policy with the expectation that you take the time you need to recharge 100% coverage of medical, dental, and vision insurance for employees, 30% of premiums for dependents, plus a tax-advantaged Flexible Spending Account Company-facilitated 401(k) retirement plan Parental leave for all new parents Work Authorization Applicants must be legally authorized to work in the United States and obtain security clearance. We are unable to sponsor work visas for this position. Massed Compute is an equal opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, veteran status, or any other characteristic protected by law. Why the work mattersAI teams need compute today, and we give it to them. Most GPU providers ask for a long contract, a support queue, and a bill that takes a spreadsheet to understand. We built the friendlier option. On demand GPUs by the hour, bare metal for production workloads, and full clusters for serious training runs, all on hardware we own and run ourselves. Real infrastructure We are an NVIDIA Preferred Partner running current data center GPUs in Tier III facilities, with SOC 2, GDPR, and HIPAA compliance behind the platform. Real customers Researchers, studios, startups, and enterprise teams run production work on Massed Compute every day. What you build reaches them the week you ship it.