[Hiring] Director of Security & Risk @SentiLink

Role Description

SentiLink's Information Security team is responsible for protecting our systems, data, and customers while enabling the business to operate securely and efficiently. We work closely with Engineering, IT, Legal, Product, and business teams to manage security risks, maintain regulatory compliance, and build effective security controls across the organization.

We're looking for a Director of Security & Risk to lead our security governance, compliance, assurance, and risk management programs. This is a leadership role with broad ownership across:

• FedRAMP
• SOC 2
• PCI DSS
• Customer and partner security assessments
• Third-party risk
• Security policy

This is not a traditional GRC role. SentiLink operates a highly technical, AWS-based environment, and many of the risks and compliance requirements we manage require deep technical understanding. We're looking for someone who can independently evaluate technical risks, understand security architecture and proposed remediations, and work effectively with engineers, auditors, regulators, and business stakeholders.

You will lead and develop a team of security and compliance professionals, establish priorities, identify gaps in our existing programs, and develop a roadmap for improving our security posture. We expect you to bring the experience and judgment to identify problems and opportunities independently, rather than simply execute an existing plan.

You will report to SentiLink's security leader and work closely with Security Engineering, which remains a separate function responsible for technical security architecture and implementation.

Success in this role means building a proactive, effective, and scalable security program that goes beyond passing audits to meaningfully reducing organizational risk.

This is a remote, US-based position.

Responsibilities

• Lead and develop SentiLink's security governance, risk, and compliance organization.
• Manage and mentor security and compliance professionals, evaluate program effectiveness, identify gaps in expertise and capacity, and develop organizational and hiring plans as the company grows.
• Own SentiLink's security compliance and audit programs, including FedRAMP, SOC 2, and PCI DSS.
• Lead external assessments, manage control effectiveness and evidence collection, oversee Vanta and compliance automation, and ensure the organization continuously meets its obligations rather than preparing only for periodic audits.
• Drive the ongoing maturity of SentiLink's government security program.
• Oversee FedRAMP continuous monitoring, POA&M governance, change-management compliance, agency-specific requirements, and assessment readiness.
• Anticipate evolving requirements, including FedRAMP 20x, and develop plans to address them.
• Establish and operate a rigorous security risk management program.
• Own the identification, assessment, documentation, escalation, and treatment of security risks, control deficiencies, and exceptions.
• Ensure material risks receive appropriate attention and that remediation is tracked through completion.
• Lead SentiLink's third-party security risk management program.
• Establish and enforce risk-based vendor diligence requirements, improve assessment quality, manage ongoing vendor oversight, and ensure material security concerns are resolved or appropriately escalated before approval.
• Own customer and partner security assurance.
• Lead complex security assessments and audits from financial institutions, government agencies, and other partners.
• Evaluate contractual security requirements in collaboration with Legal, coordinate technical responses, and ensure security representations are accurate, complete, and defensible.
• Own security policy and control governance.
• Maintain security policies, standards, and control frameworks, ensuring requirements are appropriately mapped across regulatory obligations, reflected in actual operations, and periodically evaluated for effectiveness.
• Continuously improve the effectiveness and scalability of security programs.
• Develop clear accountability, measurable outcomes, repeatable processes, and automation.
• Proactively identify emerging risks and requirements, communicate recommendations to leadership, and drive improvements across organizational boundaries.

Qualifications

• 10+ years of experience in information security, including significant experience leading security governance, compliance, assurance, or risk management programs.
• Demonstrated experience owning major security compliance and assurance programs such as FedRAMP, SOC 2, PCI DSS, or comparable regulatory frameworks.
• Strong technical understanding of modern cloud infrastructure, SaaS application security, identity and access management, vulnerability management, and security architecture.
• Proven ability to build and improve security programs, independently identify control gaps and emerging requirements, establish priorities, and translate security risks into actionable organizational plans.
• Experience managing and developing security professionals, establishing high standards for quality and accountability, and leading programs across distributed teams.
• Experience with third-party risk assessments, customer security diligence, and security risk management.
• Strong written and verbal communication skills, sound judgment, and the ability to influence engineering teams, business leaders, auditors, and external stakeholders.

Requirements

• Compensation: $200,000/year - $260,000/year + equity + benefits.
• Note: This salary range may be inclusive of several career levels, and the actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, and qualifications.

Benefits

• Employer paid group health insurance for you and your dependents.
• 401(k) plan with employer match (or equivalent for non US-based roles).
• Flexible paid time off.
• Regular company-wide in-person events.
• Home office stipend, and more!

Corporate Values

• Follow Through
• Deep Understanding
• Whatever It Takes
• Do Something Smart