[Hiring] CISO @Empirical

Role Description

This role is with Empirical itself. We're a fully remote team of around 40–50 software engineers across Latin America, with co-founders based in San Diego. Our clients, including healthcare companies and marketing agencies serving financial-industry accounts, now contractually require written security policies consistent with FTC guidance, 24-hour breach notification, approved-subprocessor controls, cyber insurance and annual audits.

We're looking for a part-time, fractional security leader to build and maintain our security program. Our environment is lean: Google Workspace for SSO and identity, SaaS tools, GitHub and Anthropic Enterprise. We host almost no infrastructure of our own, since our engineers typically work inside client environments. Some company-issued Macs are managed with MDM, and our policies are currently informal.

The engagement starts with a gap assessment and a thin layer of policies and Workspace hardening, then grows toward SOC 2 as the business justifies it. We need someone who can phase the work sensibly rather than roll out a full enterprise program on day one.

What you'll do

• Run an initial security gap assessment across our people, tools and processes
• Draft and maintain security policies, incident response plans and risk assessments
• Harden our Google Workspace environment against the CIS benchmark
• Strengthen MFA and identity management, MDM and remote wipe, centralized logging and vulnerability management
• Prepare the company for client audits and vendor security questionnaires
• Review client MSA and security addendum language, including liability caps, breach terms and subprocessor clauses
• Define secure-coding and DevSecOps practices for engineers working in client repositories
• Build a phased roadmap toward SOC 2 that fits our size and budget

Qualifications

• Experience helping US software development or IT services companies, such as staff augmentation firms, dev shops or consultancies, not only SaaS or enterprise companies
• Track record standing up security programs from near-zero and preparing small companies (20–100 people) for client audits and vendor questionnaires
• Hands-on experience with SOC 2 Type 2, NIST CSF and CIS Controls, and the judgment to know when a lighter framework is the right starting point
• Experience with Google Workspace hardening (CIS benchmark), MDM/remote wipe, MFA/identity management, centralized logging/SIEM and vulnerability management
• Ability to draft policies, incident response plans and risk assessments, and to review client MSA and security addendum language
• Comfortable with DevSecOps and secure-coding practices for engineers working in client repositories
• CISSP, CISM or equivalent certification
• Advanced English required
• Familiarity with AI tools

Requirements

• Experience with remote, distributed or LATAM-based teams
• Familiarity with HIPAA/healthcare and financial-services client requirements
• Experience working alongside fractional CTOs

What we expect from you

• 100% alignment with our core values!
• Ability to take ownership of projects from start to finish
• Strong collaboration and communication skills
• Attention to detail and a passion for delivering high-quality work

Benefits

• Remote/flexible work
• Highly competitive compensation in US dollars
• Opportunities for personal and professional development; mentorship, coaching and training as needed
• Ongoing, part-time dedication
• The opportunity to be part of an amazing, multicultural community of tech experts