• Develop and lead the company-wide information security strategy aligned to business goals. (Annual planning; ongoing oversight) • Establish and manage the risk management program, including regular reporting to executive leadership. (Quarterly reporting; ongoing monitoring) • Own SOC 2 Type 2, NIST 800-171, and other required audits end-to-end. (Annual; intensive during audit windows) • Serve as the primary point of contact for auditors and ensure continuous audit readiness. (Ongoing) • Maintain and evolve security policies, standards, and controls, including AI/LLM governance. (Quarterly review; updates as needed) • Lead incident response planning and periodic tabletop exercises. (Annual/Semi-Annual) • Partner with Engineering to ensure secure architecture, SDLC, and cloud security practices. (Ongoing) • Oversee vulnerability management, access controls, and vendor risk management. (Ongoing) • Lead customer security assurance efforts, including questionnaires and enterprise security discussions. (As needed)