[Hiring] Manager, IT Compliance & Vendor Management @The Landline Company

Role Description

Landline is seeking a Manager, IT Compliance & Vendor Management to build and run the company's cybersecurity control program and to oversee the managed service provider (MSP) that delivers its day-to-day IT operations. This single role owns two connected accountabilities: the performance of Landline's MSP, and the design, operation, and evidencing of the company's control program against the NIST Cybersecurity Framework (CSF) 2.0.

Landline operates in a regulated transportation environment and contracts with airline partners and airports that impose their own security and data-handling requirements. The control program must satisfy those obligations as well as the company's internal risk requirements.

What You Will Do

• Maintain the company's control set mapped to NIST CSF 2.0 across all six Functions: Govern, Identify, Protect, Detect, Respond, and Recover
• Administer the Vanta GRC platform, including integrations, control monitoring, evidence collection, automated test configuration, and remediation tracking
• Perform periodic control testing and design effectiveness reviews, document results, and drive remediation to closure with named owners and due dates
• Own the policy lifecycle: drafting, annual review, approval routing, publication, and attestation tracking
• Maintain the enterprise risk register, including risk scoring methodology, treatment decisions, and executive reporting
• Prepare and coordinate evidence for customer security reviews, airline partner assessments, insurance questionnaires, and external audits or assessments
• Administer the security awareness training program, including phishing simulation and completion tracking
• Serve as the primary relationship owner for the MSP, managing escalations, scheduling, and day-to-day service delivery expectations
• Monitor and report on contracted service levels, document breaches, drive root-cause analysis, and enforce contractual remedies where warranted
• Chair quarterly business reviews with the MSP, setting the agenda, tracking commitments, and maintaining a running action log
• Own the MSP contract lifecycle, including scope changes, renewals, pricing negotiation, and the exit and transition plan
• Verify that MSP-operated controls function as contracted, requiring evidence rather than assertion
• Govern access administration performed by the MSP, including joiner/mover/leaver execution, privileged access review, and periodic user access certification
• Maintain the responsibility assignment matrix (RACI) that defines which controls the MSP operates, which Landline operates, and which are shared
• Operate the vendor intake and security review process for new technology purchases
• Maintain the vendor inventory with data classification, criticality tiering, and review cadence
• Collect and review third-party assurance artifacts (SOC 2 Type II reports, ISO 27001 certificates, penetration test summaries), including analysis of complementary user entity controls and any qualified opinions
• Track vendor contract security terms, breach notification obligations, and data processing agreements
• Maintain the incident response plan and coordinate the annual tabletop exercise
• Serve as compliance lead during security incidents, covering evidence preservation, regulatory notification analysis, and post-incident reporting
• Maintain business continuity and disaster recovery documentation, and coordinate annual restoration testing with the MSP
• Deliver a recurring compliance and vendor performance report to executive leadership
• Provide security and compliance input to procurement, legal, and operations
• Track and report program metrics

Qualifications

• Five or more years in IT compliance, information security, IT audit, or IT governance, including at least two years with direct responsibility for a control program or audit function
• Hands-on experience implementing or operating a recognized security framework (NIST CSF, NIST 800-53, ISO 27001, SOC 2, CIS Controls, or equivalent)
• Experience administering or serving as a primary user of a GRC or compliance automation platform (Vanta, Drata, Secureframe, LogicGate, AuditBoard, ServiceNow GRC, or equivalent)
• Experience managing or formally overseeing an outsourced IT provider, including service level monitoring and escalation
• Working knowledge of core IT controls: identity and access management, endpoint management, logging and monitoring, vulnerability management, backup and recovery, and change management
• Ability to read a SOC 2 Type II or similar report critically, including scope boundaries, exceptions, carve-outs, and complementary user entity controls
• Clear written communication, as this role produces documentation that external parties read and rely on
• Professional certification such as CISA, CRISC, CISM, or CISSP is a plus
• Direct NIST CSF 2.0 implementation experience, particularly the Govern function and cybersecurity supply chain risk management (GV.SC), is a strong plus
• Experience in transportation, aviation, logistics, or another operationally regulated industry is a plus
• Familiarity with PCI DSS, CCPA/CPRA, or state breach notification requirements is welcome
• Prior experience building a compliance program from an early or undefined baseline is valued
• ITIL foundation or an equivalent service management background is a plus
• Contract negotiation experience with technology vendors or service providers is a plus

Location

• Remote in a major metro area in Canada or the United States, with business travel as needed

Compensation

• 120,000 – 175,000

Benefits

• Comprehensive benefits and PTO plan including medical, dental, vision, 401(k), disability, parental leave, and company-paid life insurance
• Flight benefit privileges with our airline partners
• Discretionary PTO