{"id":4304637,"url":"https://alion.io/job/rox-infosec-engineer-risk-and-compliance","title":"InfoSec Engineer (Risk and Compliance)","company":{"id":63282,"name":"Rox","domain":"rox.com","url":"https://alion.io/company/rox-com","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":84,"open_postings":19,"ghost_share":0,"stale_share":0.421,"repost_share":0,"time_to_fill_p50_days":93,"computed_at":"2026-11-14T05:58:10Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":180000,"max":220000,"currency":"USD","period":"year","gross":null,"usd_annual":220000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"GDPR","optional":false},{"name":"Git","optional":false},{"name":"GitHub","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"New Relic","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SOC 2","optional":false},{"name":"SQL","optional":false},{"name":"Datadog","optional":true},{"name":"Semgrep","optional":true}],"status":"live","first_seen_at":"2026-11-14T03:58:29Z","employer_posted_date":"2026-11-14","last_verified_at":"2026-11-14T06:22:30Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"About Us\nAt Rox, we believe in empowering people to do their best work.\nOur platform supercharges sellers with autonomous revenue agents to do the manual work so they can focus on what they do best: selling. Just as coding agents 10x’d engineering, revenue agents 10x customer work.\nWe are reimagining the revenue stack by building the world’s first revenue operating system, from the application layer to the system of context. With Rox, humans are evolving to orchestrators while agents manage the end-to-end customer lifecycle.\nRox powers Global 2000 leaders in banking, hardware, construction, and sovereign AI, while serving dominant AI winners like Ramp and Cognition.\nUnderlying all of this success is an unwavering, shared belief in the mission, with an unreasonable commitment of doing whatever it takes to make it a reality.\nThe Team\nNothing is possible without the world-class team, assembled to redefine how businesses operate.\nMembers on our team have:\nFounded and exited successful companies\n\nHeld the highest positions at Google, AWS, Confluent, and New Relic\n\nWon IMO and IOI gold medals\n\nPublished field-defining papers\n\nWe’re backed by the best, including Sequoia, General Catalyst, Google Ventures, Elad Gil, and Chris Ré.\nCore Principles\nTaste: Craft beautiful experiences.\nNo matter how small, we strive to make sure every detail is right. We care deeply about every interaction, both in terms of whether it helps the seller get the job done, but also how the product makes them feel. We get a visceral feeling when something is off and stop at nothing to make sure we make it right. We never settle, continuously exploring ways to delight sellers.\nObsession: Commit unreasonably.\nIn all aspects of our craft, we commit. We not only are immediately reactive to customers’ requests but are proactive about driving value even before they ask. We are also obsessive about always learning and honing our craft, improving ourselves and product every single day.\nAction: Get it done.\nTalking is easy but the difference comes from the execution. We lean heavily towards making thoughtful yet fast decisions and delivering immediately. We play in a field where trust is paramount. We earn the trust and right to empower the best sellers by forging a history of over-delivering on the promise at record speed.\nYour Role\nRox agents read and act on our customers’ most sensitive revenue data. Global 2000 security teams review us closely before they sign, and the trust we earn in those reviews is a core part of how we win and keep enterprise customers.\nAs an InfoSec Engineer (Risk and Compliance), you will own our compliance program as an engineer, not as a checklist keeper. You will run ISO 27001 and SOC 2, lead customer security due diligence, and manage vendor risk. You will also write the Python that collects evidence and monitors controls automatically, so audits stop eating the team’s time.\nThis is a senior individual contributor role and the second hire on our security team. You will report to Mike Tan, our Head of Security, and work closely with Engineering and Infrastructure on controls and fixes, and with Legal and Finance on security addenda, data processing agreements, and vendor contracts. Within your first three months you will fully own four areas with little supervision.\nResponsibilities\nCompliance automation (30%): Build scripts and integrations in Python against REST APIs that collect evidence, monitor controls, and generate reports. Replace manual screenshots with compliance as code.\n\nAudit operations (30%): Own the ISO 27001 certification program, including audit findings, the Statement of Applicability, the risk register, and internal audit. Keep SOC 2 compliance continuous: fix failing tests, answer evidence and auditor requests, maintain policies, and run access reviews.\n\nCustomer security due diligence (20%): Run the customer security review queue end to end, from questionnaires (CAIQ, SIG, and custom) to security addenda and due diligence calls with enterprise security teams.\n\nVendor and risk management (20%): Assess vendors, review sub-processors, and keep the risk register current as Rox adds new tools and partners.\n\nPartner with Engineering and Infrastructure on the systems behind the evidence: AWS, the software development lifecycle, change management, and vulnerability fixes.\n\nPartner with Legal and Finance on data processing agreements, customer security addenda, and vendor procurement.\n\nWhat success looks like\nFirst 3 days: You have access to Secureframe, AWS, and GitHub, can explain our SOC 2 and ISO 27001 control set and where each framework stands, and have worked a live customer security questionnaire with our Head of Security.\n\nFirst 3 weeks: You run the customer security review queue end to end and have automated evidence collection for at least one recurring audit control.\n\nFirst 3 months: You fully own ISO 27001, continuous SOC 2 compliance, customer security due diligence, and vendor risk management, and you have shipped tooling that cuts recurring manual audit work.\n\nQualifications\n4+ years in GRC or security compliance, with hands-on experience running SOC 2 and ISO 27001 audits.\n\nYou code. You write Python scripts and API integrations to automate evidence collection and control monitoring, and you are comfortable with SQL and Git.\n\nWorking knowledge of AWS security services and logs, such as IAM, CloudTrail, KMS, and Config.\n\nExperience with a GRC platform such as Secureframe, Vanta, or Drata.\n\nExperience answering enterprise security questionnaires (CAIQ, SIG) and joining due diligence calls with customer security teams.\n\nFamiliarity with GDPR and data processing agreement concepts.\n\nYou own outcomes with little supervision and can explain risk clearly to engineers, executives, and customers.\n\nBe located in or willing to relocate to San Francisco. This role is onsite at our SF HQ five days a week.\n\nNice to haves\nLed an ISO 27001 certification or a first SOC 2 Type II from scratch.\n\nExperience with JumpCloud, Datadog, or Semgrep.\n\nExperience managing third-party risk at a fast growing B2B SaaS or AI company.\n\nBenefits\nCompetitive pay with considerable equity upside (base salary range: $180,000 to $220,000 USD)\n\nMedical, dental, and vision, including 100% company-paid plans for you and eligible dependents\n\nCompany-paid life & AD&D, plus short- and long-term disability\n\n401(k) with automatic enrollment\n\nUnlimited PTO, plus paid sick leave, company holidays, and bereavement\n\nUp to 20 weeks of paid parental leave at 100% pay (birth, adoption, or foster)\n\nWellness stipend: $375/quarter\n\nLearning stipend: up to $2,000/year\n\nInternet & cell phone stipend: $25/month\n\nMental health support, virtual care, and care navigation\n\nFertility & family-building support, plus backup care membership\n\nPre-tax commuter benefits (transit & parking)\n\nSF HQ: daily catered breakfast & lunch, meal allowances, and rideshare support when commuting to the office\n\nApply\nTo apply, please fill out the application form. We're looking forward to connecting with you!","description_format":"text","description_chars":7075,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Parental leave","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":true,"industries":["Information Security","Sales Enablement","AI Agents","Marketing & Sales AI"],"lifecycle":[{"event":"open","at":"2026-11-14T06:22:30Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 6","filings_12m":6,"filings_prev_12m":2,"green_card_filings_12m":0,"median_offered_wage_usd":172500,"route":null,"cap_exempt":false,"checked_at":"2026-11-14T07:33:33+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":93,"reasons":["conf:7","win:early"],"computed_at":"2026-11-14T13:57:10Z"},"pay":{"stated_usd_annual":220000,"is_top_pay":true},"html_url":"https://alion.io/job/rox-infosec-engineer-risk-and-compliance","json_url":"https://alion.io/job/rox-infosec-engineer-risk-and-compliance.json","meta":{"generated_at":"2026-11-14T13:57:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14519,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":63282},"rest":"https://alion.io/mcp/rest/get_company?id=63282"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frox-infosec-engineer-risk-and-compliance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frox-infosec-engineer-risk-and-compliance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frox-infosec-engineer-risk-and-compliance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/rox-infosec-engineer-risk-and-compliance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frox-infosec-engineer-risk-and-compliance"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4304637}},{"tool":"search_jobs","arguments":{"company":"rox.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4304637},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}