Information Security & Compliance Manager (GRC)

RocketParts is a fast-growing software development agency founded by two experienced engineers who have built large-scale systems for companies like Riot Games, ScoreBig, and Universal Music Group.

Our mission is to empower businesses to tackle any software development challenge with purpose-fit solutions, professional expertise, realistic expectations, and results-driven outcomes.

We know firsthand the effort it takes to build great software. Our goal is to create a workplace where engineers can thrive, take pride in their work, grow, and be part of a high-performing team.

The Role

We are hiring an Information Security & Compliance Manager to lead SOC 2 Type II and PCI DSS 4.x compliance and own the security and compliance program end-to-end, keeping it audit-ready. The role runs in two directions. Internally, you own the program: policies and guidelines, access reviews, security-awareness training, vendor and risk reviews, the control-to-evidence mapping in Vanta, incident response, and the security questions that arrive from customers and prospects. Externally, you carry the same work into client engagements, supporting the companies we build software for through their own SOC 2 and PCI DSS programs - each with its own scope, auditor and deadlines. Throughout, you work alongside the engineers actually building these systems, which means your recommendations have to be implementable, not just defensible on paper.

What You'll Do

• Drive SOC 2 Type II and PCI DSS 4.x readiness and continuous compliance - scoping, control design, evidence, auditor coordination, and remediation

• Own the security and compliance program: policies and guidelines, access reviews, security-awareness training, vendor and risk reviews

• Maintain the control-to-evidence mapping in the compliance tooling (Vanta) and keep policies and operational docs consistent

• Coordinate incident response and field security questions from customers and prospects

• Support client engagements through their own SOC 2 Type II and PCI DSS 4.x programs - each with its own scope, auditor and deadlines - working alongside the engineering teams actually building those systems, so remediation is implementable rather than theoretical

What You Bring

• 4+ years in information security, GRC, or IT compliance, with hands-on SOC 2 (ideally Type II) and PCI DSS experience

• Working knowledge of common frameworks and cloud environments (GCP/AWS)

• Clear writing - audit-ready documentation and the ability to explain requirements to engineers and non-technical stakeholders

• U.S.-based. Certifications (CISSP, CISA, CISM) are a plus

Nice to Have

• Payments or fintech background - most of what we build touches money movement

• Familiarity with PCI DSS 4.x future-dated requirements, which became mandatory in March 2025

• Exposure to ISO 27001, HIPAA, GDPR or NIST

• Consulting or agency experience - you will be in front of clients and running more than one program at a time

How We Work

• Fully remote, across 14 jurisdictions and five continents

• Small senior teams. This is a startup environment rather than a large enterprise one

• AI use is mandatory for our engineers, and we expect the same pragmatism from everyone else

• Direct communication, high autonomy, low process overhead

Why Is This Great For Me?

• Fully remote

• Full premium benefits

• 401K match

• Unlimited PTO

• Your role and responsibilities will expand as the company grows

• Work remotely with the flexibility to set your own schedule and take vacations

• We respect work-life balance and don't require more than 40 hours per week unless you choose to

• Collaborate with driven and motivated colleagues

• Enjoy an open-minded culture that values opinions and feedback

• Minimal meetings, maximizing your productivity

RocketParts asks respectfully to only apply through the application form and not email/apply to them directly. Recruiters and Agencies please do not RocketParts contact directly.