[Hiring] Head of IT & Security @Fullbay

Role Description

Fullbay's Security and IT Manager owns two functions that are usually split across two people: the security program that keeps Fullbay's systems, people, and customer data safe, and the IT operations that keep the business running day to day. Reporting to the VP of IT, this role designs the security and IT program from the ground up and owns its execution end-to-end.

This role is well-suited to someone who has built a security program before, not just operated inside one. Success looks like:

• Passing SOC 2 audits with no major findings, on schedule.
• Security incidents that get triaged, contained, and resolved quickly.
• IT support that doesn't make employees wait, with devices provisioned before day one.
• A clear risk posture for leadership to see at any time.

Primary Duties & Responsibilities

• Security Program Ownership: Design, build, and continuously improve Fullbay’s security program using NIST CSF 2.0 and CIS Controls v8.1.
• Security Operations Oversight: Manage Fullbay’s MDR platform, serve as the primary responder for escalated alerts, and lead incident investigation and remediation.
• SOC 2 Readiness and Audit Management: Lead SOC 2 readiness activities and audit firm coordination.
• Tool and Platform Governance: Own and configure Fullbay’s security tooling stack and evaluate new tools or vendors.
• Policy and Standards Development: Author and enforce information security policies and ensure alignment with regulatory requirements.
• Identity and Access Management: Oversee IAM posture across Google Workspace.
• Incident Response: Develop and own the incident response plan and lead response activities.
• Risk Management: Maintain a risk register and communicate risk posture to leadership.
• Security Awareness: Oversee the security awareness training program.
• Vendor and Third-Party Risk: Assess security posture of third-party vendors and maintain a vendor risk inventory.
• End-User IT Support: Serve as the primary escalation point for technical support across the organization.
• Device & Asset Lifecycle Management: Own procurement, provisioning, and deprovisioning of company devices.
• SaaS Application Administration: Manage user provisioning and licensing across core SaaS applications.
• Onboarding & Offboarding: Own IT components of employee onboarding and offboarding.
• IT Vendor & Procurement Management: Manage relationships and contracts with IT vendors.
• Adheres to all confidentiality and compliance regulations.
• Performs other duties as assigned.

Qualifications

• 7-10 years of combined experience across IT operations and security; 10+ years preferred.
• Experience managing and responding to alerts from an MDR/EDR platform.
• Demonstrated experience owning a compliance or regulatory program (SOC 2, ISO 27001, etc.).
• SOC 2 audit experience (Type I or Type II) strongly preferred.
• Bachelor’s degree in Information Security, Computer Science, or a related field, or equivalent work experience.
• Hands-on experience administering Google Workspace and MDM platforms.

Key Skills and Qualifications

• Deep knowledge of security frameworks including NIST CSF 2.0 and CIS Controls v8.1.
• Working knowledge of MDR/EDR platforms and MDM solutions.
• Required platform experience: Google Workspace administration, Apple Business Manager, NinjaOne.
• Preferred platform experience: Proofpoint email security, Ironscales anti-phishing.
• Strong understanding of IAM concepts including SSO, MFA, and privileged access management.
• Ability to operate as a player-coach.
• Strong written and verbal communication skills.
• Experience working cross-functionally with various stakeholders.
• Preferred certifications: CISSP, CISM, CISA, CCSP, CompTIA Security+, or CASP+.
• Strong general IT troubleshooting skills across Mac and Windows environments.
• Experience with IT ticketing/helpdesk systems and asset management tools.

Physical Demands and Work Environment

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Regularly required to sit at a desk in front of a computer.
• Frequently requires the use of hands and arms for reaching.
• Specific vision abilities required include close vision and color vision.
• Noise level in the work environment is usually moderate.