Senior Manager of Information Security

Join Plume, a leading SaaS company in the smart home industry, as a Senior Manager of Information Security. In this role, you will lead and mature our security program, ensuring full alignment with ISO 27001 and SOC 2 requirements. You will be responsible for authoring and maintaining policies and procedures, managing relationships with external auditors, and owning the security of our infrastructure, networks, cloud environments, and applications. You will also lead and develop the security team, establish secure SDLC practices, and act as the primary security voice to Engineering, Product, IT, Legal, and executive leadership.

• Assumer la responsabilité de la gestion et de l'amélioration continue du programme de sécurité de l'information, en veillant à son alignement avec les exigences des normes ISO 27001 et SOC 2.
• Rédiger, formaliser et maintenir les politiques, normes et procédures nécessaires pour combler les lacunes restantes et maintenir la préparation à la certification.
• Diriger, encadrer et développer l'équipe de sécurité, en établissant des rôles clairs, des flux de travail et un sens de la responsabilité.

• Direct experience operating within (not just achieving) ISO 27001 and SOC 2 frameworks — you know what "audit-ready" looks like day to day, not just at renewal time
• Bachelor's degree in Information Security, Computer Science, Computer Engineering or related field or equivalent work experience
• 6-8+ years in information security, with 3+ years in a leadership role owning a security program end-to-end
• Excellent communication skills — able to flex between a whiteboard session with engineers and a risk briefing with the board
• Experience managing external auditors, penetration testers, and compliance vendors
• Strong technical depth in cloud security (AWS/GCP), network security, and modern application security (SDLC, AppSec tooling, container/Kubernetes security a plus)
• A track record of leading security teams that engineers actually like working with — you understand that unenforced policy is theater, and that adoption comes from good tooling and clear communication, not mandates
• Experience building or rebuilding policies and procedures from the ground up in a scaling SaaS environment
• CISSP, CISM, or similar certification
• Experience implementing or operating under ISO 27701 (privacy extension to 27001) and the NIST Cybersecurity Framework (CSF)
• Experience in a company of similar size/stage (post-certification, scaling team)