Director of Security & IT

Experience owning security, IT, or compliance responsibilities in a SaaS or technology organization Hands-on experience with SSO, identity & access management, and internal IT systems Strong understanding of SOC 2 and/or HIPAA Security Rule Comfort operating in regulated environments Ability to both execute tactically and design systems strategically Clear communicator who can work with engineers, legal, vendors, and non-technical stakeholders Experience leading or supporting a SOC 2 audit (strongly preferred) Experience in a healthcare, fintech, or regulated SaaS company (strongly preferred) Familiarity with JAMF or other MDM platforms (strongly preferred) Familiarity with Okta or similar IAM tools (strongly preferred) Familiarity with Cloud security concepts (AWS, logging, IAM, audit trails) (strongly preferred) Experience managing vendors or managed service providers (strongly preferred) Prior experience as a Security Engineer, IT Manager, or GRC Lead (bonus) Scripting or automation experience (Bash, Python) (bonus) Incident response or security program ownership experience (bonus)

Own Found’s security posture across infrastructure, applications, vendors, and internal systems Lead SOC 2 readiness and audits Maintain and operationalize HIPAA Security Rule safeguards Own vendor security reviews, risk assessments, and security questionnaires Partner with Legal on security clauses, BAAs, and contract reviews Define and maintain security policies, standards, and incident response procedures Own Found’s IT operations for a remote-first workforce Administer and evolve Okta, Google Workspace, Device management (JAMF / MDM), and Network access Ensure reliable onboarding and offboarding of employees and contractors Maintain hardware and software inventory Oversee or operate the helpdesk function Build and document repeatable, auditable IT processes Design systems that scale without heroics Identify opportunities for automation Evaluate and manage vendors Partner with Engineering leadership to ensure security is embedded Translate security and IT risk into clear, actionable recommendations for leadership Lay the foundation for a scalable IT and Information Security function