IT Security Lead

About Your Role 

As our IT Security Lead at QGenda, you will serve as a senior individual contributor responsible for leading IT security operations, risk management, and governance, risk, and compliance (GRC) initiatives across our IT systems, infrastructure, and SaaS applications. You will identify and reduce risk, strengthen security controls, and mature our GRC program from policy and control design through audit readiness, evidence collection, and remediation. Working closely with IT and Help Desk, Legal, Product Development, and business teams, you will streamline control management and help ensure alignment with applicable security standards. You will also partner with Product Development’s security team to align enterprise IT security with QGenda’s broader security program.

How You’ll Make an Impact 

• Lead IT security operations and advance QGenda’s enterprise IT security strategy and GRC initiatives, translating business objectives and risk priorities into measurable improvements.
• Oversee security controls across QGenda’s IT platforms and assets, including identity, endpoints, SaaS applications, and network infrastructure. Promote secure architecture and configuration, assess control effectiveness and attack surface, address gaps, define security metrics, and report security posture to executive leadership.
• Serve as IT’s primary security subject matter expert (SME), providing daily guidance to IT Systems Administrators and Help Desk teams supporting IT, CRM, and Procurement on secure configuration and control implementation. Partner with system owners to drive remediation.
• Collaborate with IT, Help Desk, and business stakeholders to align security initiatives with business objectives and integrate security into enterprise IT projects, system changes, and operational processes. Coordinate with Product Development’s security team where initiatives overlap.
• Lead the IT vulnerability management program, including regular scans and assessments, risk-based prioritization, timely remediation and patching, and validation of fixes.
• Lead internal and external IT security audits and compliance assessments, including control mapping, evidence coordination, gap analysis, remediation tracking, and audit readiness.
• Improve GRC operations by automating control testing, evidence collection, and compliance workflows, and establishing ongoing monitoring of control status.
• Develop, implement, and maintain IT security policies, standards, and best practices aligned with applicable frameworks, audit requirements, regulations, and customer and contractual obligations including NIST, ISO 27001, SOC 1, SOC 2, SOX, HIPAA, and FedRAMP, as applicable.
• Evaluate security risks associated with internal AI adoption and other new technologies, including configuration, data exposure, vulnerabilities, and potential impacts to existing controls. Recommend appropriate safeguards.
• Coordinate incident preparedness and response with relevant teams, capture lessons learned, and provide security awareness training and guidance to staff.

Who You Are 

• You operate effectively as a senior individual contributor, independently leading cross-functional security initiatives that measurably improve security posture and influencing teams across IT and the business.
• You bring hands-on experience securing enterprise IT environments across identity and access management, endpoints, SaaS applications, network infrastructure, and macOS and Windows environments.
• You have experience with enterprise security and IT platforms such as Okta, Zscaler, CrowdStrike, Google Workspace, Microsoft, Jamf, Intune, and Meraki, or comparable tools.
• You understand enterprise risk management and GRC, and can apply frameworks and requirements such as NIST, ISO 27001, SOC 1, SOC 2, SOX, HIPAA, and FedRAMP, as applicable, to practical security controls.
• You have experience leading or supporting security audits and compliance assessments in highly regulated environments with extensive compliance requirements, including working with auditors, mapping controls, gathering evidence, remediating gaps, and monitoring controls. You’re familiar with GRC automation and continuous monitoring platforms. Familiarity with tools such as Vanta is a plus.
• You have experience managing vulnerability programs, including scanning, risk prioritization, remediation coordination, patching, and validation. Familiarity with tools such as Tenable is a plus.
• You can assess security risks in SaaS applications, internal AI tools, and emerging technologies, including configuration, access, data exposure, vulnerabilities, and impacts to existing controls. You can also use AI and machine learning to improve security workflows while maintaining human oversight and critical judgment.
• You have experience supporting incident response and security awareness. You communicate effectively with internal and external stakeholders and can explain cybersecurity principles and risks to technical and nontechnical audiences.

Experience You Bring 

• Minimum of 5 years of experience in IT security, GRC, security engineering, security operations, or related fields.
• Bachelor’s degree from an accredited college or university.