{"id":3538744,"url":"https://alion.io/job/irth-solutions-cybersecurity-lead-security-engineering-compliance-lead","title":"Cybersecurity Lead / Security Engineering & Compliance Lead","company":{"id":7550,"name":"Irth Solutions","domain":"irthsolutions.com","url":"https://alion.io/company/irth-solutions","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":95,"open_postings":4,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":60,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":110000,"max_usd":227000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":453},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CVE","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"NERC CIP","optional":false},{"name":"SOC 2","optional":false},{"name":"Windows","optional":false},{"name":"Windows Server","optional":false},{"name":"Wiz","optional":false},{"name":"LLM","optional":true}],"status":"live","first_seen_at":"2026-10-30T18:34:50Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-10-31T12:33:17Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Irth\nIrth develops SaaS solutions for utility damage prevention and infrastructure risk management. Gas, electric, telecommunications, and pipeline operators across the United States and Canada rely on our products-including UtiliSphere, DigTix, Insights, Borealis, and Stake Center-to protect critical infrastructure.\nBecause our customers operate critical infrastructure, they expect strong security practices and adherence to rigorous security standards.\nWe are seeking a hands-on Cybersecurity Lead to strengthen and oversee Irth's security program. This individual will serve as both a cybersecurity practitioner and policy leader, partnering closely with engineering, infrastructure, IT, GRC, and executive leadership.\nThe ideal candidate can translate security findings into actionable remediation, lead incident response, establish security standards, and clearly communicate Irth's security posture to customers and stakeholders.\nKey Responsibilities\n1. Vulnerability Management & Remediation\nOwn the triage and prioritization of security findings from SAST tools, infrastructure security assessments, penetration tests, and newly disclosed CVEs.\nAssess risk and severity, establish remediation priorities, and assign ownership and deadlines.\nPartner directly with engineering and infrastructure teams to resolve vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning.\nIntegrate security findings into engineering work management systems, ensuring every finding has an assigned owner, tracking ticket, and target remediation date.\nReport remediation progress, outstanding risks, and security trends to IT, engineering, and executive leadership.\nProvide appropriate vulnerability and remediation updates to customers.\n2. Incident Response & Security Communications\nLead security incident response from initial detection and investigation through containment, remediation, and post-incident review.\nCoordinate urgent vulnerability and CVE responses across technical teams.\nEstablish and manage incident communications, including internal status updates, executive briefings, and Customer Experience talking points.\nPrepare accurate, timely customer-facing communications regarding potential exposure, remediation status, and detection activities.\nMaintain incident response runbooks and on-call escalation procedures.\nConduct regular incident response tabletop exercises.\n3. Cloud, Identity & Access Security\nOwn cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.\nEstablish and enforce identity and access management policies covering:\nLeast-privilege access\nRole-based access and permissions\nSession duration and expiration\nMulti-factor authentication (MFA)\nPrivileged access management\nEmployee and contractor onboarding, transfers, and offboarding\nManage and strengthen identity controls across Microsoft Entra ID and AWS IAM.\nConduct regular access reviews for employees, contractors, and third-party vendors.\nIdentify and remediate excessive permissions, inactive accounts, and access control gaps.\n4. Security Policy, Compliance & Customer Trust\nDevelop, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST Cybersecurity Framework (CSF) and ISO 27001.\nOwn the technical security controls supporting SOC 2 Type II and ISO 27001 compliance.\nPartner with Governance, Risk, and Compliance (GRC) teams on audit readiness, evidence collection, and remediation of control gaps.\nMonitor regulatory and industry requirements affecting critical infrastructure customers, including:\nTSA pipeline security directives\nNERC CIP-related customer security expectations\nApplicable Canadian privacy legislation\nTranslate applicable regulatory and customer requirements into practical technical security controls.\nLead technical responses to customer security questionnaires in partnership with GRC.\nRepresent Irth's cybersecurity program during customer security reviews and calls.\nManage third-party penetration testing engagements and security vendors.\nSupport cybersecurity due diligence for acquisitions.\nRole Expectations\nThis is a hands-on leadership role requiring both technical execution and program ownership. The successful candidate will be expected to:\nDrive security findings through resolution rather than simply identify risks.\nEstablish accountability and measurable remediation timelines.\nWork effectively across engineering, infrastructure, IT, GRC, and executive teams.\nBalance security risk, business priorities, and operational requirements.\nCommunicate technical security issues clearly to both technical and nontechnical audiences.\nBuild customer confidence through a mature, transparent, and well-managed security program.\nRequirements\nRequired Qualifications\n8+ years of experience in cybersecurity engineering or security operations, including at least 3 years leading a security program or function, preferably within a SaaS organization.\nHands-on cloud security experience across AWS and Microsoft Azure, including:\nIdentity and Access Management (IAM)\nCloud network security controls\nSecurity logging, monitoring, and audit trails\nAWS CloudTrail and Microsoft Entra sign-in and audit logs\nCloud security posture management tools such as Wiz\nDemonstrated experience owning vulnerability management end to end, including identifying, triaging, prioritizing, assigning, tracking, and driving remediation in partnership with engineering teams.\nProven experience leading security incident response, including delivering clear, timely written communications to executive leadership and customers during high-pressure situations.\nWorking knowledge of SOC 2 Type II, ISO 27001, and NIST Cybersecurity Framework (CSF), including experience serving as a key technical control owner through at least one SOC 2 Type II audit.\nAbility to review and interpret application code, infrastructure-as-code (IaC), and Linux and Windows server configurations to evaluate security risks and validate remediation approaches.\nStrong written and verbal communication skills, sound technical judgment, and the ability to distinguish between issues requiring immediate escalation and those that can be resolved through routine remediation.\nPreferred Qualifications\nExperience supporting utilities, pipelines, energy providers, or other critical-infrastructure customers, including familiarity with TSA pipeline security directives or NERC CIP requirements.\nFamiliarity with Canadian privacy requirements, including Quebec's Law 25.\nExperience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.\nExperience conducting cybersecurity due diligence or supporting security integration activities related to mergers and acquisitions.\nRelevant industry certifications, such as:\nCertified Information Systems\nAI Use in Hiring\nAs part of our hiring process, this role may use artificial intelligence or automated tools to assist in reviewing and screening applications. These tools support, but do not replace, human judgment in hiring decisions.\nRole Type\nThis is a New position.\nCompensation\nThe salary range for this role is USD $ 195K. This range reflects the base salary only and does not include any other compensation components like OTE. Any offers made are dependent on factors including and not limited to experience, skills, and location.\nBenefits\nWhat We Offer\nJoin a dynamic, growing company with a strong reputation in its industry.\nCompetitive salary.\nComprehensive health plan options, including medical, dental, and vision coverage.\n401(k) plan with company match.\nFlexible PTO policy plus company-paid holidays.\nAdditional benefits, including life insurance, pet insurance, and employee discounts and perks programs.\nGenerous one-time work-from-home stipend to help you set up your home workspace.\nCompany events and opportunities to connect, including monthly team lunches, volunteer outings, and quarterly gatherings.\nHybrid employees have access to complimentary snacks, beverages, and coffee at our Columbus, Ohio office.","description_format":"text","description_chars":8193,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Company events","Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Low-Code & No-Code Platforms","Field Service Management Software"],"lifecycle":[{"event":"open","at":"2026-10-30T18:34:50Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":0,"expected_fill_days":60,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/irth-solutions-cybersecurity-lead-security-engineering-compliance-lead","json_url":"https://alion.io/job/irth-solutions-cybersecurity-lead-security-engineering-compliance-lead.json","meta":{"generated_at":"2026-10-31T15:48:11Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24661,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":7550},"rest":"https://alion.io/mcp/rest/get_company?id=7550"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Firth-solutions-cybersecurity-lead-security-engineering-compliance-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Firth-solutions-cybersecurity-lead-security-engineering-compliance-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Firth-solutions-cybersecurity-lead-security-engineering-compliance-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/irth-solutions-cybersecurity-lead-security-engineering-compliance-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Firth-solutions-cybersecurity-lead-security-engineering-compliance-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3538744}},{"tool":"search_jobs","arguments":{"company":"irthsolutions.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3538744},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}