Senior Manager – Information Security & Compliance

Role: Senior Manager – Information Security & Compliance

The person will own and build Orvera’s Information Security and Compliance function. This is a hands-on role involving security governance, compliance, risk management, cloud/application security, customer security reviews, and incident response.

Key Responsibilities

• Own the Information Security and Compliance program.
• Manage SOC 2 Type II audit end-to-end.
• Handle PCI DSS compliance.
• Work across SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, and CCPA/CPRA requirements.
• Handle enterprise customer security questionnaires and security due diligence reviews.
• Work with US/EU enterprise customers on security requirements.
• Manage security risks across cloud, applications, data, and third parties.
• Work with Engineering on cloud security, Secure SDLC, vulnerability management, and penetration testing.
• Manage security incidents and remediation.
• Establish security controls for AI/LLM and conversational voice platforms.
• Manage third-party security risks and security partners.

Required Experience

• 8+ years of Information Security experience.
• 3+ years in a startup/growth-stage SaaS or technology product company.
• Experience building security controls, policies, and processes from scratch.
• Personal ownership of at least one SOC 2 Type II audit cycle.
• Hands-on PCI DSS experience.
• Experience with enterprise customer security questionnaires and due diligence reviews.
• Practical experience in cloud security, application security, risk management, incident response, and third-party risk.