[Hiring] Global IT Manager, Security & Compliance @Serverfarm

Role Description

As a key member of the Serverfarm team, you will be responsible for:

• Compliance and Risk
  • Own the IT evidence program across ISO 27001:2022, SOC 1, SOC 2, PCI DSS, and HIPAA for a portfolio of approximately thirteen operating sites.
  • Act as IT's counterpart to external certification bodies and auditors — prepare for audits, present and defend control evidence, and own remediation of IT findings through to closure.
  • Manage third-party and vendor risk management for IT: vendor security assessments, a maintained vendor register with periodic reassessment.
  • Own customer-facing security due diligence — questionnaires, audits and assessments.
  • Maintain the IT risk register and opportunities-for-improvement log, and drive items to closure rather than allowing them to age.
  • Coordinate IT participation in business continuity and disaster recovery testing, and ensure results are documented.
• Security Operations
  • Manage vulnerability management end to end — scanning coverage, triage, remediation ownership, escalation of anything aging, and periodic reporting to leadership.
  • Work alongside counterparts to oversee endpoint detection and response and the security alerting pipeline; ensure alerts reach an owner and that investigations are recorded and closed.
  • Lead security incident response — containment, investigation, root cause, customer-facing incident reporting, and post-incident hardening.
  • Manage email security, including domain authentication posture and secure email gateway configuration.
  • Run the security awareness program — monthly phishing simulation, results analysis, and targeted follow-up.
• Identity and Access
  • Contribute to identity governance across a hybrid estate spanning cloud and on-premises IdP.
  • Oversee access review cadence, privileged access controls, and the joiner-mover-leaver process from an IT control standpoint, including third-party and contractor access.

Qualifications

• Eight or more years in information security, IT compliance, or IT risk, with meaningful time spent in both compliance and technical security work.
• Demonstrated ownership of an ISO 27001 program, including direct experience preparing for and defending findings with an external certification body.
• Hands-on experience with at least two of: SOC 2, PCI DSS, HIPAA, NIS2, or DORA.
• Genuine technical depth — comfortable reading firewall and authentication logs, assessing a vulnerability scan, evaluating an OAuth consent request, and challenging an engineer's proposed remediation on its merits.
• Experience with vulnerability management platforms, endpoint detection and response tooling, and enterprise identity platforms.
• Experience leading security incident response through to a customer-facing or executive-facing conclusion.
• Ability to communicate risk credibly to both engineers and executives, and to hold vendors and internal stakeholders accountable without formal authority over them.
• Willingness to travel to sites periodically for audit, assessment, and control validation.

Requirements

• $135,000 - $145,000 a year

Benefits

• Equal opportunity workplace
• Paid time off
• Paid holidays
• 401k
• FULL coverage medical, dental, and vision