Product Security Assurance & Compliance (PSAC) Manager

SecureLogix is a company focused on enhancing product security and compliance. They are seeking a Product Security Assurance & Compliance Manager to lead and manage the PSAC program, ensuring security documentation, compliance, and risk management across the organization.

Responsibilities:

• Conduct a comprehensive audit of all existing security-related documentation across the enterprise
• Inventory all existing security policies, procedures, standards, and evidence artifacts across the organization
• Identify duplicate, conflicting, or outdated documentation and consolidate into a single, authoritative source of truth
• Establish a version-controlled, centralized documentation repository accessible to authorized personnel
• Define and enforce documentation governance standards to prevent re-fragmentation over time
• Conduct a structured gap analysis mapped to relevant frameworks (NIST CSF, ISO 27001, CIS Controls, etc.) and customer requirements
• Maintain a prioritized remediation roadmap with clear ownership, timelines, and measurable outcomes
• Track remediation progress and provide regular status reporting to executive leadership
• Use recurring questionnaire themes to proactively identify systemic gaps before they surface in customer engagements
• Manage the full lifecycle of all inbound questionnaires (SPSRD, SIG, CAIQ, HECVAT, custom)
• Build and maintain a centralized repository of pre-approved responses and supporting evidence artifacts to enable rapid, consistent turnaround
• Collaborate with Engineering, IT, Legal, and executive leadership to gather accurate technical and policy information
• Track all assessment timelines and ensure on-time delivery to support active sales cycles
• Leverage assessment responses to inform gap analysis and product-level risk identification
• Design and deploy an internal, self-service security Q&A tool enabling any authorized SecureLogix employee to quickly retrieve accurate, pre-approved answers to common security questions
• Establish an escalation workflow: questions that do not return a sufficient answer are automatically flagged and routed to the PSAC Manager for resolution and knowledgebase enrichment
• Invest time to achieve a thorough understanding of SecureLogix product architecture, data handling, authentication mechanisms, and customer-facing integrations
• Maintain fluency sufficient to accurately map product behavior to security controls and framework requirements when responding to customer assessments
• Identify product-level security risks or deficiencies surfaced through customer questionnaires, assessments, or gap analysis
• Submit product security improvement ideas through the formal Product Management process for prioritization and review
• Collaborate with Product Management and Engineering to ensure new features and enhancements are evaluated against documented security policies prior to release
• Sign-off on feature releases to ensure compliance with documented security policies and practices
• Lead planning, execution, and maintenance of security certifications including ISO 27001 and other frameworks as required
• Manage certification project plans, timelines, and milestones from scoping through audit completion
• Coordinate with external auditors, assessors, and consultants throughout the certification lifecycle
• Identify and remediate control gaps in collaboration with IT and Engineering to achieve and maintain certification readiness
• Develop, maintain, and continuously improve security policies, standards, and procedures aligned to NIST CSF, CIS Controls, ISO 27001, and customer requirements
• Maintain a controls matrix mapping organizational controls to multiple frameworks and customer requirements
• Manage the organization's risk register, including regular risk assessments and treatment plans
• Develop and maintain an AI security policy addressing emerging AI/ML risks and usage
• Ensure all security documentation is current, version-controlled, and audit-ready at all times
• Partner with Sales to address security concerns during the sales cycle, participating in customer calls and presentations as the security subject matter expert
• Develop customer-facing security materials: whitepapers, trust center content, compliance summary sheets, and presentation-ready security briefings
• Proactively identify certification or compliance milestones that will strengthen competitive positioning
• Maintain and deliver the employee AI security awareness training program, including onboarding and annual refresher training
• Coordinate with IT to ensure technical controls align with documented policies and compliance requirements

Requirements:

• Bachelor's degree in Information Security, Cybersecurity, Business, or related field (or equivalent professional experience)
• 4+ years in information security compliance, GRC, or security audit/assessment roles
• Extensive hands-on experience responding to customer security assessments and third-party questionnaires
• Strong working knowledge of NIST CSF, CIS Controls, ISO 27001
• Demonstrated ability to read and understand technical architecture documentation, data flow diagrams, and API/integration specifications — sufficient to engage credibly with Engineering and accurately represent product behavior in security assessments
• Excellent skills producing clear, accurate, and professional security documentation for internal and customer-facing audiences
• Ability to manage multiple concurrent certification and assessment timelines with clear ownership and accountability
• Industry certifications: CISSP, CISM, CISA, CRISC, CCSK, or CompTIA Security+
• Familiarity with Microsoft 365 security and compliance tooling (Purview, Defender, Entra ID)
• Experience working in or supporting a sales organization with security compliance responsibilities
• Background in telecommunications, VoIP, or enterprise security products
• Experience with GRC platforms (Vanta, Drata, OneTrust, or similar)
• Experience designing internal knowledge management or Q&A automation systems
• Knowledge of AI security policy development and emerging AI/ML risk frameworks
• Experience managing compliance in a small-to-midsize enterprise (50-150 employees) with limited resources