# Associate Security Program Manager

[Oneleet](https://gurify.com/jobs?q=Oneleet) · United States · Posted today

Remote

[Project Manager](https://gurify.com/jobs/project-manager)

[Security](https://gurify.com/jobs/security)

[Apply on the original posting → (opens in a new tab)](https://jobs.ashbyhq.com/oneleet/e48124e4-97be-4f45-8fc9-8a20fd9deaee)

## Job description

### ABOUT ONELEET

Oneleet is one of the fastest-growing security and compliance platforms in history. We are on a mission to change the compliance and security industry by making cybersecurity and compliance effective, easy, and painless. We provide a platform that helps companies build, manage, and monitor their cybersecurity programs and achieve compliance standards such as SOC 2 and ISO 27001 efficiently, without cutting corners.

Having just raised a $33 million Series A, we are rapidly growing in customers and employees. Our team has decades of experience in security and compliance. Join our team of opinionated rebels and help us build a category-defining company reshaping the broken and fragmented compliance and cybersecurity industry.

### WHO WE’RE LOOKING FOR:

We value passionate self-starters with a growth mindset and a bias for action and personal accountability. If you love solving hard problems, thrive in ambiguity, and want to make a real impact, you’ll fit right in.

### We’re especially drawn to:

- Rebels with a cause — frustrated with the status quo and eager to disrupt it.

- Opinionated (but not obstinate) builders — decisive yet collaborative, who help us move fast.

- Clear communicators — who own their ideas and follow through.

Our mission is simple: make effective cybersecurity painless. We believe cybersecurity should empower, not burden. This belief unites our team and drives every decision we make.

If you’re ready to challenge the status quo and help shape the future of cybersecurity, we’d love to meet you.

### THE ROLE

The Associate Security Program Manager has hybrid responsibility across internal security compliance audit, and security program management. A key part of your focus is on our internal QA team, reviewing client evidence and controls before clients face their external auditors. The other half is client-facing, supporting our Security Program Managers as they guide companies from first call to audit-ready security programs.

Your evidence reviews protect clients from failed audits and false confidence. Your client work makes sure the fixes are real, so compliance becomes a byproduct of actual security. You'll grow into a full Security Program Manager by doing both. You care about security, you like explaining it, and you want to know why every control exists, not just whether it's checked.

### KEY RESPONSIBILITIES

### Internal Audit & Controls Review (~50%)

- Review client-uploaded evidence across SOC 2, ISO 27001, PCI, HIPAA, and GDPR for completeness, accuracy, and sufficiency.

- Perform QA checks on individual controls, and support final pre-audit reviews before clients engage third-party auditors.

- Identify gaps or weak evidence and write clear findings with specific, actionable fixes.

- Help maintain internal QA standards and review methodologies, and contribute to guidance documents that help clients produce better evidence.

- Track audit readiness metrics and flag opportunities to improve our process.

- Share feedback with our product and engineering teams on where the platform can better support audit readiness.

### Client-Facing Security Program Support (~50%)

- Join and help run consultation calls with new clients to understand their security posture, infrastructure stack, compliance requirements, and goals.

- Support Security Program Managers in building security programs of technical, operational, and administrative controls based on industry frameworks and each client's actual environment.

- Help clients turn programs into real implementations: policies, procedures, configurations, and software integrations.

- Serve as a responsive point of contact for clients, translating security concepts for both technical and non-technical stakeholders.

- Help coordinate with auditors so client programs meet auditor expectations.

- Use what you learn in QA reviews to help clients get evidence right the first time.

### REQUIREMENTS

### Security & Compliance

- 3+ years in information security, compliance, or audit (GRC, IT or compliance auditing, security operations, security advisory, or a security-adjacent customer success or IT support role).

- Working knowledge of SOC 2, ISO 27001, HIPAA, GDPR, and PCI, and of how controls map to real infrastructure and operations.

- Familiarity with cloud and infrastructure technologies such as AWS, Azure, GCP, Kubernetes, Docker, or Terraform, and the ability to learn new ones quickly.

- Exposure to reviewing or preparing evidence for compliance audits.

### Client & Execution Skills

- Client-facing or stakeholder-facing experience, with strong organization and project management instincts.

- Excellent attention to detail and a quality control mindset.

- Clear written communication for documenting findings, and confident verbal communication on client calls.

- Comfortable switching between focused review work and a high-volume, high-interruption client queue.

- Self-driven, comfortable with ambiguity, and able to manage multiple client engagements at once in a fast-moving startup environment.

### BONUS EXPERIENCE

- Progress toward or holding a certification such as CISA, Security+, CISSP (Associate), CISM, or ISO 27001 Lead Auditor/Implementer.

- Experience with compliance automation platforms.

- Background in customer success, IT support, or technical support.

- Startup experience, whether working at one or consulting for them.

WHY ONELEET?

At Oneleet, you’ll join a tight-knit team of rebels redefining the cybersecurity industry. We move fast, own our work, and challenge outdated models to make security effortless and effective for companies.

### Here’s what makes us special:

- We value impact over titles, autonomy over micromanagement, and clarity over jargon.

- You’ll tackle meaningful, hard problems with real-world consequences.

- You’ll work with smart, kind, and ambitious teammates who lift each other up.

### PERKS & BENEFITS

- Comprehensive health & wellness benefits

- 20 days PTO per year, plus 8 floating holiday

- Remote work culture

- Team off-sites in stunning places (Amsterdam, Italy, etc).

- Competitive compensation & equity

We hire globally and compensate competitively within each market using geographic pay bands. The range for this role reflects a US national baseline. Offers for candidates in higher cost-of-labor markets (e.g., San Francisco, New York, Zurich) may fall at or above the top of the posted range, while offers in other markets are benchmarked to local standards and are lower. Within any range, individual compensation is determined by work location, skills and experience demonstrated through the interview process, and relevant education or training. This posting reflects base salary only and does not include equity or benefits.

### Remote-First & Global Hiring

We’re a remote-first company and hire globally in regions where we can legally engage talent directly or via our employer-of-record (EOR) partner. If you’re based outside the U.S., we’ll explore the most compliant hiring arrangement for your location. We make hiring decisions based on merit, skills, and potential regardless of location.

### U.S. Hiring & E-Verify

For U.S.-based candidates, Oneleet participates in E-Verify to confirm employment eligibility, in accordance with federal regulations. We are an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law.

### How we use AI in this Hiring Process

This company uses automated technology, including AI-assisted tools, to assist in reviewing applications, assessing candidate qualifications, and detecting fraudulent submissions. These tools analyze application data and identity signals to support, but not replace, human hiring decisions. All final hiring decisions are made by a human reviewer. Candidates who require accommodation or who wish to request information about how these tools are used, including requesting the bias audit results, may contact recruiting@oneleet.com. This process is conducted in compliance with applicable federal, state, and local laws.

### Notice for New York City Residents:

You have a right to take at least 10 business days to decide whether to proceed with submitting your information through this process. By continuing, you confirm your understanding of this notice. If you choose to proceed before the 10-business-day period expires, you are making a knowing and voluntary decision to do so.

**Live in Oneleet’s hiring system.** Read from the company's own applicant tracking system, not reposted from a job board — so it's a real, open requisition rather than an ad that outlived the role.

We remove it as soon as it disappears at source.

## More jobs like this

- PE [Lead Technical Program Manager - Remote](https://gurify.com/job/lead-technical-program-manager-remote-at-pencil-10984c149917) Pencil · United States · today
- IS [Technical Program Manager (DDMR), Cambridge, MA](https://gurify.com/job/technical-program-manager-ddmr-cambridge-ma-at-isomorphiclabs-4a8540df2702) Isomorphiclabs · Cambridge, MA · last week
- CH [Program Manager [Vespid]](https://gurify.com/job/program-manager-vespid-at-chaosindustries-2f87cb51a47f) Chaosindustries · El Segundo, United States · last week
- ZO [Senior Technical Program Manager, Manufacturing Capacity](https://gurify.com/job/senior-technical-program-manager-manufacturing-capacity-at-zoox-3667a2ab454e) Zoox · Fremont, CA · last week
- TA [Program Manager](https://gurify.com/job/program-manager-at-tanium-429107d36539) Tanium · Bellevue, WA (Hybrid); Durham, NC (Hybrid) · 6 days ago
- CH [Program Manager, Massed Modular Aircraft](https://gurify.com/job/program-manager-massed-modular-aircraft-at-chaosindustries-7839bbc3e9d4) Chaosindustries · El Segundo, United States · last week

```json
{"@context":"https://schema.org/","@type":"JobPosting","title":"Associate Security Program Manager","description":"\u003Ch3\u003EABOUT ONELEET\u003C/h3\u003E\u003Cp\u003EOneleet is one of the fastest-growing security and compliance platforms in history. We are on a mission to change the compliance and security industry by making cybersecurity and compliance effective, easy, and painless. We provide a platform that helps companies build, manage, and monitor their cybersecurity programs and achieve compliance standards such as SOC 2 and ISO 27001 efficiently, without cutting corners.\u003C/p\u003E\u003Cp\u003EHaving just raised a $33 million Series A, we are rapidly growing in customers and employees. Our team has decades of experience in security and compliance. Join our team of opinionated rebels and help us build a category-defining company reshaping the broken and fragmented compliance and cybersecurity industry.\u003C/p\u003E\u003Ch3\u003EWHO WE\u2019RE LOOKING FOR:\u003C/h3\u003E\u003Cp\u003EWe value passionate self-starters with a growth mindset and a bias for action and personal accountability. If you love solving hard problems, thrive in ambiguity, and want to make a real impact, you\u2019ll fit right in.\u003C/p\u003E\u003Ch3\u003EWe\u2019re especially drawn to:\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003ERebels with a cause \u2014 frustrated with the status quo and eager to disrupt it.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EOpinionated (but not obstinate) builders \u2014 decisive yet collaborative, who help us move fast.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EClear communicators \u2014 who own their ideas and follow through.\u003C/li\u003E\u003C/ul\u003E\u003Cp\u003EOur mission is simple: make effective cybersecurity painless. We believe cybersecurity should empower, not burden. This belief unites our team and drives every decision we make.\u003C/p\u003E\u003Cp\u003EIf you\u2019re ready to challenge the status quo and help shape the future of cybersecurity, we\u2019d love to meet you.\u003C/p\u003E\u003Ch3\u003ETHE ROLE\u003C/h3\u003E\u003Cp\u003EThe Associate Security Program Manager has hybrid responsibility across internal security compliance audit, and security program management. A key part of your focus is on our internal QA team, reviewing client evidence and controls before clients face their external auditors. The other half is client-facing, supporting our Security Program Managers as they guide companies from first call to audit-ready security programs.\u003C/p\u003E\u003Cp\u003EYour evidence reviews protect clients from failed audits and false confidence. Your client work makes sure the fixes are real, so compliance becomes a byproduct of actual security. You\u0026#39;ll grow into a full Security Program Manager by doing both. You care about security, you like explaining it, and you want to know why every control exists, not just whether it\u0026#39;s checked.\u003C/p\u003E\u003Ch3\u003EKEY RESPONSIBILITIES\u003C/h3\u003E\u003Ch3\u003EInternal Audit \u0026amp; Controls Review (~50%)\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EReview client-uploaded evidence across SOC 2, ISO 27001, PCI, HIPAA, and GDPR for completeness, accuracy, and sufficiency.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EPerform QA checks on individual controls, and support final pre-audit reviews before clients engage third-party auditors.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EIdentify gaps or weak evidence and write clear findings with specific, actionable fixes.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHelp maintain internal QA standards and review methodologies, and contribute to guidance documents that help clients produce better evidence.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ETrack audit readiness metrics and flag opportunities to improve our process.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EShare feedback with our product and engineering teams on where the platform can better support audit readiness.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EClient-Facing Security Program Support (~50%)\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EJoin and help run consultation calls with new clients to understand their security posture, infrastructure stack, compliance requirements, and goals.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ESupport Security Program Managers in building security programs of technical, operational, and administrative controls based on industry frameworks and each client\u0026#39;s actual environment.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHelp clients turn programs into real implementations: policies, procedures, configurations, and software integrations.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EServe as a responsive point of contact for clients, translating security concepts for both technical and non-technical stakeholders.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EHelp coordinate with auditors so client programs meet auditor expectations.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EUse what you learn in QA reviews to help clients get evidence right the first time.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EREQUIREMENTS\u003C/h3\u003E\u003Ch3\u003ESecurity \u0026amp; Compliance\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003E3\u002B years in information security, compliance, or audit (GRC, IT or compliance auditing, security operations, security advisory, or a security-adjacent customer success or IT support role).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EWorking knowledge of SOC 2, ISO 27001, HIPAA, GDPR, and PCI, and of how controls map to real infrastructure and operations.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EFamiliarity with cloud and infrastructure technologies such as AWS, Azure, GCP, Kubernetes, Docker, or Terraform, and the ability to learn new ones quickly.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExposure to reviewing or preparing evidence for compliance audits.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EClient \u0026amp; Execution Skills\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EClient-facing or stakeholder-facing experience, with strong organization and project management instincts.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExcellent attention to detail and a quality control mindset.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EClear written communication for documenting findings, and confident verbal communication on client calls.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EComfortable switching between focused review work and a high-volume, high-interruption client queue.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ESelf-driven, comfortable with ambiguity, and able to manage multiple client engagements at once in a fast-moving startup environment.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EBONUS EXPERIENCE\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EProgress toward or holding a certification such as CISA, Security\u002B, CISSP (Associate), CISM, or ISO 27001 Lead Auditor/Implementer.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EExperience with compliance automation platforms.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EBackground in customer success, IT support, or technical support.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EStartup experience, whether working at one or consulting for them.\u003C/li\u003E\u003C/ul\u003E\u003Cp\u003EWHY ONELEET?\u003C/p\u003E\u003Cp\u003EAt Oneleet, you\u2019ll join a tight-knit team of rebels redefining the cybersecurity industry. We move fast, own our work, and challenge outdated models to make security effortless and effective for companies.\u003C/p\u003E\u003Ch3\u003EHere\u2019s what makes us special:\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EWe value impact over titles, autonomy over micromanagement, and clarity over jargon.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EYou\u2019ll tackle meaningful, hard problems with real-world consequences.\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003EYou\u2019ll work with smart, kind, and ambitious teammates who lift each other up.\u003C/li\u003E\u003C/ul\u003E\u003Ch3\u003EPERKS \u0026amp; BENEFITS\u003C/h3\u003E\u003Cul\u003E\u003Cli\u003EComprehensive health \u0026amp; wellness benefits\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003E20 days PTO per year, plus 8 floating holiday\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ERemote work culture\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ETeam off-sites in stunning places (Amsterdam, Italy, etc).\u003C/li\u003E\u003C/ul\u003E\u003Cul\u003E\u003Cli\u003ECompetitive compensation \u0026amp; equity\u003C/li\u003E\u003C/ul\u003E\u003Cp\u003EWe hire globally and compensate competitively within each market using geographic pay bands. The range for this role reflects a US national baseline. Offers for candidates in higher cost-of-labor markets (e.g., San Francisco, New York, Zurich) may fall at or above the top of the posted range, while offers in other markets are benchmarked to local standards and are lower. Within any range, individual compensation is determined by work location, skills and experience demonstrated through the interview process, and relevant education or training. This posting reflects base salary only and does not include equity or benefits.\u003C/p\u003E\u003Ch3\u003ERemote-First \u0026amp; Global Hiring\u003C/h3\u003E\u003Cp\u003EWe\u2019re a remote-first company and hire globally in regions where we can legally engage talent directly or via our employer-of-record (EOR) partner. If you\u2019re based outside the U.S., we\u2019ll explore the most compliant hiring arrangement for your location. We make hiring decisions based on merit, skills, and potential regardless of location.\u003C/p\u003E\u003Ch3\u003EU.S. Hiring \u0026amp; E-Verify\u003C/h3\u003E\u003Cp\u003EFor U.S.-based candidates, Oneleet participates in E-Verify to confirm employment eligibility, in accordance with federal regulations. We are an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law.\u003C/p\u003E\u003Ch3\u003EHow we use AI in this Hiring Process\u003C/h3\u003E\u003Cp\u003EThis company uses automated technology, including AI-assisted tools, to assist in reviewing applications, assessing candidate qualifications, and detecting fraudulent submissions. These tools analyze application data and identity signals to support, but not replace, human hiring decisions. All final hiring decisions are made by a human reviewer. Candidates who require accommodation or who wish to request information about how these tools are used, including requesting the bias audit results, may contact recruiting@oneleet.com. This process is conducted in compliance with applicable federal, state, and local laws.\u003C/p\u003E\u003Ch3\u003ENotice for New York City Residents:\u003C/h3\u003E\u003Cp\u003EYou have a right to take at least 10 business days to decide whether to proceed with submitting your information through this process. By continuing, you confirm your understanding of this notice. If you choose to proceed before the 10-business-day period expires, you are making a knowing and voluntary decision to do so.\u003C/p\u003E","identifier":{"@type":"PropertyValue","name":"Gurify","value":"associate-security-program-manager-at-oneleet-63f8414f287d"},"url":"https://gurify.com/job/associate-security-program-manager-at-oneleet-63f8414f287d","datePosted":"2026-10-21","validThrough":"2026-12-05T23:59:59Z","hiringOrganization":{"@type":"Organization","name":"Oneleet","sameAs":"https://jobs.ashbyhq.com/oneleet"},"directApply":false,"jobLocationType":"TELECOMMUTE","applicantLocationRequirements":{"@type":"Country","name":"United States"}}
```

```json
{"@context":"https://schema.org/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Jobs","item":"https://gurify.com/jobs"},{"@type":"ListItem","position":2,"name":"United States","item":"https://gurify.com/jobs/united-states"},{"@type":"ListItem","position":3,"name":"Associate Security Program Manager","item":"https://gurify.com/job/associate-security-program-manager-at-oneleet-63f8414f287d"}]}
```