Cybersecurity Lead / Security Engineering & Compliance Lead

Irth develops SaaS solutions for utility damage prevention and infrastructure risk management. Gas, electric, telecommunications, and pipeline operators across the United States and Canada rely on our products—including UtiliSphere, DigTix, Insights, Borealis, and Stake Center—to protect critical infrastructure.
Because our customers operate critical infrastructure, they expect strong security practices and adherence to rigorous security standards.
We are seeking a hands-on

Cybersecurity Lead

to strengthen and oversee Irths security program. This individual will serve as both a cybersecurity practitioner and policy leader, partnering closely with engineering, infrastructure, IT, GRC, and executive leadership.
The ideal candidate can translate security findings into actionable remediation, lead incident response, establish security standards, and clearly communicate Irths security posture to customers and stakeholders.
Assess risk and severity, establish remediation priorities, and assign ownership and deadlines.
Partner directly with engineering and infrastructure teams to resolve vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning.
Integrate security findings into engineering work management systems, ensuring every finding has an assigned owner, tracking ticket, and target remediation date.
Report remediation progress, outstanding risks, and security trends to IT, engineering, and executive leadership.
Provide appropriate vulnerability and remediation updates to customers.
Coordinate urgent vulnerability and CVE responses across technical teams.
Establish and manage incident communications, including internal status updates, executive briefings, and Customer Experience talking points.
Prepare accurate, timely customer-facing communications regarding potential exposure, remediation status, and detection activities.
Cloud, Identity & Access Security
Own cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.
Establish and enforce identity and access management policies covering:
Employee and contractor onboarding, transfers, and offboarding
Manage and strengthen identity controls across Microsoft Entra ID and AWS IAM.
Conduct regular access reviews for employees, contractors, and third-party vendors.
Identify and remediate excessive permissions, inactive accounts, and access control gaps.
Security Policy, Compliance & Customer Trust
Develop, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST Cybersecurity Framework (CSF) and ISO 27001.
Own the technical security controls supporting SOC 2 Type II and ISO 27001 compliance.
Partner with Governance, Risk, and Compliance (GRC) teams on audit readiness, evidence collection, and remediation of control gaps.
Monitor regulatory and industry requirements affecting critical infrastructure customers, including:
TSA pipeline security directives
NERC CIP-related customer security expectations
Translate applicable regulatory and customer requirements into practical technical security controls.
Lead technical responses to customer security questionnaires in partnership with GRC.
Represent Irths cybersecurity program during customer security reviews and calls.
Support cybersecurity due diligence for acquisitions.
Drive security findings through resolution rather than simply identify risks.
Work effectively across engineering, infrastructure, IT, GRC, and executive teams.
Balance security risk, business priorities, and operational requirements.
Build customer confidence through a mature, transparent, and well-managed security program.
8+ years of experience in cybersecurity engineering or security operations, including at least 3 years leading a security program or function, preferably within a SaaS organization.
~ Hands-on cloud security experience across AWS and Microsoft Azure, including:
~ Cloud network security controls
~ Security logging, monitoring, and audit trails
~ AWS CloudTrail and Microsoft Entra sign-in and audit logs
~ Cloud security posture management tools such as Wiz

Demonstrated experience owning vulnerability management end to end, including identifying, triaging, prioritizing, assigning, tracking, and driving remediation in partnership with engineering teams.
Proven experience leading security incident response, including delivering clear, timely written communications to executive leadership and customers during high-pressure situations.
Working knowledge of SOC 2 Type II, ISO 27001, and NIST Cybersecurity Framework (CSF), including experience serving as a key technical control owner through at least one SOC 2 Type II audit.
Ability to review and interpret application code, infrastructure-as-code (IaC), and Linux and Windows server configurations to evaluate security risks and validate remediation approaches.
Strong written and verbal communication skills, sound technical judgment, and the ability to distinguish between issues requiring immediate escalation and those that can be resolved through routine remediation.
Experience supporting utilities, pipelines, energy providers, or other critical-infrastructure customers, including familiarity with TSA pipeline security directives or NERC CIP requirements.
Experience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.
Experience conducting cybersecurity due diligence or supporting security integration activities related to mergers and acquisitions.
Certified Information Systems

AI Use in Hiring
As part of our hiring process, this role may use artificial intelligence or automated tools to assist in reviewing and screening applications. Comprehensive health plan options, including medical, dental, and vision coverage.
~Flexible PTO policy plus company-paid holidays.
~ Additional benefits, including life insurance, pet insurance, and employee discounts and perks programs.
~ Generous one-time work-from-home stipend to help you set up your home workspace.
~ Hybrid employees have access to complimentary snacks, beverages, and coffee at our Columbus, Ohio office.