SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 150,000 - 200,000 / annual
Sofar Ocean is building the world's largest real-time ocean sensor network, with Spotter buoys collecting ocean data globally and software like Wayfinder enabling voyage optimization for commercial shipping, government, and defense customers. The company is based at Pier 28 in San Francisco with approximately 100 employees and is growing rapidly.
In this role, you will own Sofar's corporate security and identity infrastructure while leading the security compliance program. You will translate security priorities into working controls and serve as the primary internal point person for customer security reviews. Helpdesk and facilities IT are managed by a dedicated IT partner whom you'll collaborate with closely.
Key responsibilities include:
- Identity and Access Management: Own Google Workspace as the identity provider. Roll out SSO and SCIM provisioning across SaaS tools, automate joiner/mover/leaver processes, and conduct periodic access reviews.
- Endpoints: Own device management (MDM, EDR) and endpoint detection and response, including device compliance policies.
- Security Operations: Tune and triage SIEM detections. Track vulnerability remediation across Dependabot findings and penetration test results. Maintain and exercise the incident response plan.
- Compliance: Drive day-to-day work toward SOC 2 and other compliance certifications. Maintain policies, operate the compliance platform, collect audit evidence, and review vendors and subprocessors.
- Customer Trust: Own responses to customer security questionnaires and assessments. Ensure answers are accurate, consistent, and defensible.
- Vendor Management: Manage relationships with the managed IT provider, security vendors, advisors, contractors, and auditors.
The role is based at the Pier 28 office in San Francisco a few days per week to work seamlessly with the team, though remote applicants are considered.
Requirements:
- 5+ years in IT systems, corporate security, or security engineering, ideally at a startup
- Clear, well-reasoned perspective on how a ~100-person startup should approach security, including investment priorities, risk acceptance, and compliance sequencing
- Hands-on administration of Google Workspace and an SSO/SCIM stack, plus MDM and EDR tooling
- Working knowledge of AWS IAM and scripting ability in Python or similar for automation
- Experience through at least one SOC 2 or ISO 27001 audit from the inside
- Clear, precise writing with preference for defensible claims over optimistic ones
Nice to have: Experience with Vanta or Drata, AWS CloudFormation, Auth0, or SIEM detection engineering.
