Job description
About the Role
We are looking for a senior, execution-focused Lead to own production release management, change control, and security and compliance operations. This role is about owning the day-to-day: getting changes out safely, keeping SOC 2 evidence current, and running hands-on security operations. This is a hands-on delivery role. Strategic and cross-company leadership responsibilities — roadmap ownership, architecture review boards, and mentoring — remain with existing leadership and are not part of this position.
Key Responsibilities
- Own production release and deployment pipelines (Octopus Deploy and TeamCity), including zero-downtime deployment practices and resolving stuck or failed deployments.
- Approve production changes, hotfixes, and feature toggle changes, and schedule maintenance windows with appropriate customer notice through the status page.
- Own SOC 2 change management and audit evidence collection, working directly with external auditors through full SOC 2, HIPAA, or PCI audit cycles.
- Run hands-on security operations: vulnerability and patch remediation tracking, endpoint security tooling, and triage of externally reported vulnerabilities.
- Administer identity and access management — access reviews, MFA, privileged access controls, and granting or revoking production access to databases, VPN, and deployment tooling.
- Support customer-facing security questionnaires and the security sections of RFPs.
- Handle the monthly flow of infrastructure and access tickets that require change approval or production access grants.
- Be available for occasional on-call and off-hours support when production needs it.
Must-Have Requirements
- 8+ years of total infrastructure or release engineering experience.
- 5+ years directly owning production release and deployment pipelines, including rollback practices.
- 5+ years owning SOC 2 (or equivalent) change management and audit evidence processes.
- 5+ years of hands-on security operations experience.
- Identity and access management administration experience, including access reviews and privileged access controls.
- Experience supporting customer-facing security questionnaires or RFP security sections.
- Experience working directly with external auditors through at least one full audit cycle.
Nice to Have
- AWS security experience: IAM, security groups, CloudTrail.
- Familiarity with vulnerability disclosure programs (HackerOne, Bugcrowd) or coordinating third-party penetration tests.
- GRC or compliance tooling experience (Vanta, Drata, or similar).
- Experience with customer trust or security review platforms (Conveyor, CSA STAR).
- Prior experience at a SaaS company serving regulated industries.
What We're Looking For Beyond Skills
- Comfortable being the person who says no to a change that isn't ready — even under pressure — and just as comfortable explaining exactly why, so the requester is never left guessing.
- High ownership and a calm, structured approach to production incidents and failed releases.
- Clear, precise communication with engineering teams, auditors, and customer security teams.
- Strong attention to detail and a disciplined approach to documentation and evidence.
*If you take pride in shipping changes safely and keeping security and compliance airtight in production, we'd love to hear from you.*