Information Security Manager

Overview

This role is for someone who likes doing a lot of different things well. Our Information Security & Compliance team is small, so governance, audit, and risk aren’t separate lanes here. You’ll work across policy management, SOC 2 and other audits, risk management, and vendor risk, and you’ll see how all of it connects, which is experience you won’t get in a role that covers only one piece.

You’ll be the right hand to our VP of Information Security & Compliance, with a real path to grow into broader security leadership. You’ll own the compliance process day to day, work hands-on across audits, policy, and risk, mentor a junior teammate, and talk through risks with engineering, IT, and the business. Our customers are large utilities and energy companies that run billions in regulated assets on our SaaS platform, so they ask hard questions about how we protect it, and you’ll help us answer them.

Responsibilities

Success will be measured by audits that go smoothly, policies and risks that are well managed, and leadership that always knows where we stand. Audits, policy, and risk management are the heart of the job. That looks like:

• Facilitating our SOC 1 and SOC 2 attestations and other external audits from scoping through fieldwork, so evidence arrives on time and audit readiness is a year-round habit, not a scramble.
• Owning information security policy governance, with clear owners, a steady review cadence, and records an auditor can follow.
• Running our enterprise security risk program, and explaining why each risk matters in plain security and SaaS terms, so every risk has an owner, a plan, and a date.
• Managing vendor risk assessments and helping choose and set up the GRC tooling (think Drata, Vanta, Full Circle, or UpGuard) that makes the whole team more effective.
• Reporting program health to leadership and partnering with CloudOps, IT, and Dev, while supporting security awareness training, customer questionnaires, and incident response.
• Mentoring a junior teammate along the way and helping shape how the team grows.

Qualifications

• You’ve worked in the SaaS industry and understand software and cloud environments well enough to talk through risk with engineers.
• You’ve facilitated audits such as SOC 2, ISO 27001, or NIST CSF 2.0 (FedRAMP experience counts too).
• You have eight or more years in cybersecurity compliance, audit, or risk management.
• You can talk across security domains and explain why a risk matters to an engineer or an executive.
• You like wearing a lot of hats. Maybe you started in a smaller organization and covered it all, or you’ve built deep governance expertise somewhere larger. Either path works.

PowerPlan is an EOE

Applicant Privacy Notice

Please note that this is a hybrid role that involves a combination of onsite work from our corporate office as well as work from home. While we strive to accommodate flexible working arrangements when sensible, there will be times when onsite work is required. This could include scheduled office days, team meetings, client meetings, or special events.