Empirical - Fractional CISO
Confirmed on the employer's own hiring board on Oct 24, 2026. First seen by Alion on Oct 21, 2026. Empirical scores B on the Alion truth index.
Overview
Application
IMPORTANT: At the moment we are only considering candidates located in Latin America. Please do not apply if you are not located in Latin America.
About Empirical
Empirical empowers early and growth stage tech companies to create the right products in the right way by providing two pivotal services:
Product & Technology Leadership: Our clients entrust critical decisions to our network of top-tier US-based CTOs and CPOs. We provide fractional, project, or advisory based support, combining highly experienced talent with a flexible approach.
Product Development Teams: We provide our clients with high performing, senior product development talent through a scalable staff augmentation model and ongoing support. We focus on Latin America to find exceptional talent, with time zone and cultural compatibility.
We are proud to be a people first company, where we prioritize building meaningful, long lasting human connections with clients and team members alike, while embracing diversity and uniqueness. With this foundation and our focus on talent, we help create great products that people love.
Our values
Care about people first
Strive to add value always
Lead with integrity
Have fun every step of the way
The Opportunity
This role is with Empirical itself. We're a fully remote team of around 40-50 software engineers across Latin America, with co-founders based in San Diego. Our clients, including healthcare companies and marketing agencies serving financial-industry accounts, now contractually require written security policies consistent with FTC guidance, 24-hour breach notification, approved-subprocessor controls, cyber insurance and annual audits.
We're looking for a fractional security leader to build and maintain our security program. Our environment is lean: Google Workspace for SSO and identity, SaaS tools, GitHub and Anthropic Enterprise. We host almost no infrastructure of our own, since our engineers typically work inside client environments. Some company-issued Macs are managed with MDM, and our policies are currently informal.
The engagement starts with a gap assessment and a thin layer of policies and Workspace hardening, then grows toward SOC 2 as the business justifies it. We need someone who can phase the work sensibly rather than roll out a full enterprise program on day one.
What you'll do
Run an initial security gap assessment across our people, tools and processes
Draft and maintain security policies, incident response plans and risk assessments
Harden our Google Workspace environment against the CIS benchmark
Strengthen MFA and identity management, MDM and remote wipe, centralized logging and vulnerability management
Prepare the company for client audits and vendor security questionnaires
Review client MSA and security addendum language, including liability caps, breach terms and subprocessor clauses
Define secure-coding and DevSecOps practices for engineers working in client repositories
Build a phased roadmap toward SOC 2 that fits our size and budget
Your qualifications and experience
Must haves
Experience helping US software development or IT services companies, such as staff augmentation firms, dev shops or consultancies, not only SaaS or enterprise companies
Track record standing up security programs from near-zero and preparing small companies (20-100 people) for client audits and vendor questionnaires
Hands-on experience with SOC 2 Type 2, NIST CSF and CIS Controls, and the judgment to know when a lighter framework is the right starting point
Experience with Google Workspace hardening (CIS benchmark), MDM/remote wipe, MFA/identity management, centralized logging/SIEM and vulnerability management
Ability to draft policies, incident response plans and risk assessments, and to review client MSA and security addendum language
Comfortable with DevSecOps and secure-coding practices for engineers working in client repositories
CISSP, CISM or equivalent certification
Advanced English required.
Familiarity with AI tools.
Nice-to-haves
Experience with remote, distributed or LATAM-based teams
Familiarity with HIPAA/healthcare and financial-services client requirements
Experience working alongside fractional CTOs
What we expect from you
100% alignment with our core values!
Ability to take ownership of projects from start to finish
Strong collaboration and communication skills
Attention to detail and a passion for delivering high-quality work
What we offer
Remote/flexible work
Highly competitive compensation in US dollars
Opportunities for personal and professional development; mentorship, coaching and training as needed
Ongoing, fractional dedication
The opportunity to be part of an amazing, multicultural community of tech experts
Why work with us?
We pride ourselves on our core values and have proven that putting people first creates a thriving and collaborative work environment.
We seek to accommodate and balance individual needs with client needs, understanding each one of us is unique.
We offer benefits such as remote/flexible work, selective paid training, mentorship programs, referral programs and more.
We are selective in the projects we take on to ensure our teams are engaged in challenging, meaningful, enjoyable opportunities that will provoke creativity, innovation and growth!