SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Campfire is a Series B AI-native core accounting platform ($65M Series B led by Accel and Ribbit Capital) replacing outdated ERP systems with modern financial automation. Customers trust the platform with general ledgers, bank details, payroll, and vendor data.
You will be Campfire's first full-time CISO, building an in-house security and compliance program from a fractional vCISO model. Security is increasingly a deal gate for enterprise customers, and your role is to close deals faster while maintaining customer trust and operational safety.
Key responsibilities:
**Customer Security & Deal Support**: Answer security questionnaires, TPRMs, and RFPs (SIG, CAIQ, custom) with fast turnaround. Join customer and prospect calls with CIOs and IT security teams. Maintain a trust center with policies, pentest reports, network architecture, and insurance certificates.
**Compliance & Audits**: Own SOC 1 and SOC 2 (Type I and II) end-to-end, including scope, auditor management, and customer follow-up. Lead the path to ISO 27001, ISO 42001, and other frameworks. Manage Vanta as the system of record for controls and evidence.
**Privacy & Contracts**: Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs/DPF), DORA, and non-US privacy laws. Review security clauses in customer contracts. Own data retention, export, residency, and GovCloud requests.
**Security Operations & Incident Response**: Own the incident response plan, run tabletop tests, and lead response during incidents. Manage customer breach notifications and post-incident write-ups. Own detection and email security (SIEM, EDR, email protection, identity alerting).
**Identity & Access**: Own Okta (SSO, phishing-resistant MFA, SCIM), MDM, and least-privilege production access. Support customer-facing SSO/SCIM setups.
**Resilience & Policy**: Own BCDR plans, RTO/RPO targets, and backup/restore testing. Maintain information security, responsible AI, and vendor management policies. Run background and sanctions screening.
**AI Security**: Answer customer questions on the AI assistant (models, prompt/response retention, logging, opt-out). Govern AI vendors and subprocessors.
First 90 days: Take over customer security reviews from the vCISO firm with clear intake/turnaround process; finish Vanta migration and publish trust center; finalize and test BCDR and incident response plans; close post-incident hardening (email security, Okta alerting, MDM, EDR); present 12-month security and certification roadmap to CTO.
Reports to the CEO. Works closely with Sales, Legal, and Engineering.
**Requirements:**
- 10+ years in security, with 3+ years leading a program at a B2B SaaS company
- Has owned SOC 1/SOC 2 audits end-to-end; ISO 27001 experience a plus
- Comfortable on calls with enterprise CIOs and auditors; enjoys helping close deals
- Hands-on with AWS, Okta, Google Workspace, EDR, and SIEM tooling
- Working knowledge of GDPR, DPAs, and contract security terms
- Has led real incident response, including customer communication
- Fintech, ERP, or accounting software background a strong plus
- Pragmatic builder: starts as a team of one, hires as we grow
