Security & Compliance Manager

Location: Spain, remote within Spain

Company

hirify.global is a growing SaaS company with an international team, enterprise customers, and a product and engineering-focused culture.

What you will do

• Own the ISO 27001 compliance program, maintain policies and evidence in Vanta, and coordinate internal and external audits.
• Lead hirify.global's first SOC 2 Type II program in 2027, including planning, auditor management, evidence collection, examination, reporting, and ongoing operation.
• Handle customer security assessments, explain safeguards, and maintain the Trust Center and reusable security responses.
• Manage security, privacy, AI, vendor, and operational GDPR risks, including risk registers, subprocessors, DPAs, privacy assessments, and AI governance records.
• Coordinate annual penetration testing, remediation, retesting, engineering tickets, recovery tests, and incident-response preparation.
• Partner with Platform and Application Engineering on cloud security, identity, secure development, access reviews, security validation, training, phishing exercises, automation, and AI-assisted workflows.

Requirements

• 5+ years of experience in information security, security compliance, or GRC, with substantial responsibility in a SaaS or cloud-based software environment.
• Personal experience operating security programs, closing gaps, and delivering results beyond recommendations and audit reports.
• Independent ownership of an ISO 27001 audit cycle and substantial delivery responsibility for a completed SOC 2 Type II cycle, including control design, operating evidence, auditor expectations, and remediation.
• Technical understanding of cloud architecture, authentication and authorization, least privilege, endpoint protection, logging, and common application vulnerabilities.
• Experience with vendor assessments, risk registers, operational GDPR requirements, data processing agreements, retention, and international data transfers.
• Experience completing enterprise security questionnaires and explaining technical safeguards accurately in excellent written and spoken English.
• Ability to organize competing requests, manage external providers, follow up with contributors, drive work to completion, and escalate material risks or capacity conflicts.
• Practical, adaptable approach to recurring security work, audit preparation, customer questionnaires, and engineering discussions.

Nice to have

• Experience leading a first-time SOC 2 program.
• Familiarity with Azure, Entra ID, Intune, Microsoft Defender, AI-assisted workflows, or AI governance.
• ISO 42001 experience.

Culture & Benefits

• Autonomy to drive design decisions and make a visible impact with little bureaucracy and few meetings.
• Supportive, creative, and collaborative international environment with regular virtual and in-person team activities.
• Opportunity to work with colleagues experienced in large enterprises and technology startups.
• Full-time, permanent employment with remote work from Spain.