{"id":4218500,"url":"https://alion.io/job/reflexion-interactive-technologies-fractional-ciso-reflexion","title":"Fractional CISO - Reflexion","company":{"id":4427687,"name":"Reflexion Interactive Technologies","domain":"reflexion.co","url":"https://alion.io/company/reflexion-interactive-technologies","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"JazzHR","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Cloudflare","optional":false},{"name":"EU AI Act","optional":false},{"name":"GDPR","optional":false},{"name":"HIPAA","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false},{"name":"SQL","optional":false}],"status":"live","first_seen_at":"2026-11-13T03:45:56Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T03:45:56Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Fractional CISO\nThis is a fully remote (work-from-home) position. Work from anywhere in the United States.\nContract / fractional · ~15-25 hrs in the first 60 days, then ~5-10 hrs per quarter\nAbout Reflexion\nReflexion Interactive Technologies builds neuro-cognitive and physiological sensing technology - vision-performance training and respiration-waveform sensing - used by athletes, teams, and now a global consumer-eyewear partner. We are a ~10-person, AWS-hosted company based in Lancaster, PA, closing enterprise partnerships that bring enterprise-grade vendor-security requirements with them.\nThe role\nWe are hiring a fractional CISO to be the accountable security executive behind our compliance program as we finalize a major enterprise deal. This is not a build-a-SOC, hire-a-team role: our application-layer security is strong (bcrypt, encrypted sessions, CSRF, parameterized SQL, strict CSP, MFA/RBAC, AES-256 at rest, TLS 1.2+), our compliance calendar and evidence pipeline are run day-to-day by an internal compliance system, and engineering is handled by our CTO. What we need is the credentialed human who signs, validates, and represents.\nYou will work directly with the CEO (deal owner) and CTO (implementation owner). Our internal compliance agent drafts the documents, tracks the obligations register, and maintains the evidence locker - you review, correct, and put your name on what is true.\nWhat you will do - first 60 days\nReview and harden our Statement of Applicability + evidence package (ISO 27001/NIST-mapped) responding to an enterprise customer's Information Security Addendum - built largely from an existing, customer-reviewed evidence base.\nSign the risk assessment and SoA as the named security officer; be the security contact enterprise vendor-risk teams can call.\nSit on 2-3 customer security-diligence calls (enterprise vendor-risk / InfoSec reviewers) alongside the CEO.\nValidate what we attest against reality with the CTO (controls verification and gap triage: centralized logging, admin RBAC/audit trail, secrets management).\nAdvise on a security-exception / compensating-controls request and, if required, scope a right-sized SOC 2 Type I path (RFQs prepared; you would manage auditor selection and the engagement).\nScope and manage our first external penetration test (vendor shortlist ready) and own findings triage with the CTO.\nOngoing - a few hours a quarter\nQuarterly review of the compliance-calendar output (access reviews, risk-assessment refresh, training, phishing simulations, BC/DR and restore tests).\nAnnual re-attestation support; named contact for customer audits under contractual audit rights.\nIncident readiness: review our breach-notification runbook (24-72h contractual clocks) and advise if an incident ever triggers it.\nTell us when a new deal's requirements genuinely change our posture - versus when to negotiate them down. We optimize for minimum-viable compliance and want a partner who respects that philosophy rather than gold-plating.\nWhat we are looking for\nPrior CISO / vCISO / security-lead experience at a company that sold to large enterprises - you have personally survived enterprise vendor-risk review (security questionnaires, information-security addenda, right-to-audit clauses) from the vendor side.\nHands-on fluency with ISO 27001 / NIST CSF control mapping, SOC 2 (readiness through audit), and pragmatic compensating-controls / security-exception practice.\nComfortable being the named, accountable individual - signing SoAs and risk assessments, taking customer calls, standing behind attestations.\nTechnical enough to verify controls in an AWS + Cloudflare stack with the CTO (IAM, KMS, CloudTrail/logging, network posture) - you do not implement, but you cannot be bluffed.\nWorking knowledge of HIPAA applicability analysis (we maintain a no-PHI / not-a-business-associate posture and need it defended, not expanded) and GDPR-adjacent vendor obligations (we have EU counsel; you coordinate, not own).\nPlain-spoken, fast, allergic to compliance theater. You will be asked \"is this actually required, or negotiable?\" constantly - we want the honest answer.\nBonus: consumer wellness / health-adjacent data classification; EU AI Act awareness; prior work with AI-assisted compliance tooling.\nWhat this is not\nNot full-time, and no conversion pressure - genuinely fractional.\nNot a program-build from zero: policies (v1.0), an evidence base, an obligations register, a DPA/SCC pack, and counsel relationships already exist.\nNot an implementation role: engineering changes belong to the CTO; you verify and advise.\nEngagement & compensation\nHourly contract (rate DOE) or an equivalent small monthly block. Front-loaded first 60 days (~15-25 hours), then ~5-10 hours per quarter. Direct line to the CEO and CTO. NDA required; the work references a Fortune-Global-500-scale counterparty under confidentiality.\nHow to apply\nSend a short note covering: (1) an enterprise vendor-security review you got a small company through - what you accepted and what you pushed back on; (2) your hourly rate and availability over the next 60 days. Resume/LinkedIn welcome; the note matters more.","description_format":"text","description_chars":5164,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Sports","Higher Education","Athlete Training"],"lifecycle":[{"event":"open","at":"2026-11-13T03:45:56Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":7,"reasons":["conf:1","win:early"],"computed_at":"2026-11-13T05:11:28Z"},"pay":null,"html_url":"https://alion.io/job/reflexion-interactive-technologies-fractional-ciso-reflexion","json_url":"https://alion.io/job/reflexion-interactive-technologies-fractional-ciso-reflexion.json","meta":{"generated_at":"2026-11-13T05:11:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10996,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4427687},"rest":"https://alion.io/mcp/rest/get_company?id=4427687"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Freflexion-interactive-technologies-fractional-ciso-reflexion"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Freflexion-interactive-technologies-fractional-ciso-reflexion"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Freflexion-interactive-technologies-fractional-ciso-reflexion"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/reflexion-interactive-technologies-fractional-ciso-reflexion\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Freflexion-interactive-technologies-fractional-ciso-reflexion"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4218500}},{"tool":"search_jobs","arguments":{"company":"reflexion.co","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4218500},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}