Chief Information Security Officer - MeridianLink

The Chief Information Security Officer will lead MeridianLink’s information security functions. This position provides leadership and oversight for MeridianLink’s security program. Responsible for both IT security operations, and information security compliance with a focus on MeridianLink’s product security architecture and SaaS security operations.

The position will work with peers in Engineering, Enterprise Architects and the Product Owners to provide technical insight and industry perspective in the creation, delivery, and integration of complex and comprehensive security solutions.

Key Responsibilities

Management and Leadership

•Technical experience to lead on architectural and technical security by design

•Develop strong working relationships with technology and business partners across multiple locations in support of security, compliance, and audits for the organization.

•Provide strong positive and collaborative leadership to executive teams, other departments such as engineering, product management, legal, support, and IT. Also, lead and manage Information Security teams composed of internal and external resources

•Take initiative to identify gaps and changes required to address security threats and compliance with products.

•Present risk information to executives and advise on remediations.

Information Security

•Responsible for the review and certification of all back up and disaster recovery plans

•Oversee the secure development, design and implementation of new applications and changes to MeridianLink SaaS applications

•Direct and manage computing and information security plans, policies, programs and project schedules

•Continue to build and enhance secure application design and development policies and practices

•Partner with IT to ensure that the technical and security needs of internal systems and services are met

•Develop and maintain security policies and procedures including, but not limited to, incident response plans, business continuity plans, etc.

•Lead the implementation and operation of security services such as vulnerability assessment, threat monitoring and incident response

•Oversee security design and architecture including IaaS and PaaS cloud migrations

•Lead vulnerability, change, and configuration management, for applications and infrastructure

•Oversee administration of security services, including antivirus, IDS/IPS, data loss prevention, and security monitoring.

•Customer facing responsibilities, such as pre-sales, facilitating due diligence requests, RFPs, and customer security concerns

•First line incident response and support for remediation

•Provide Identity and Access management solutions to ensure appropriate access to sensitive data

•Monitor the SDLC and ensure that coding is done with secure best practices (OWASP framework or equivalent) including modern deployment methods such as CI/CD pipelines

Security Assessments and Audit Management

•Experience leading red/blue security teams.

•Conduct application assessments (design reviews and pen tests) and lead implementation of associated application security technologies

•Perform risk assessments on new technologies or discovered vulnerabilities

Information Security Awareness

•Implement organization-wide security awareness initiatives and provide timely information to employees and leadership regarding new and emerging threats

•Collaborate with all teams to communicate and enforce security controls

Legal and Governance

•Develop and maintain processes, policies, and technical controls in support of certifications programs and continual compliance with ISO/IEC 27001/2, SOC 1, SOC 2, and other applicable international privacy regulations.

•Continuously monitor security controls for all IT Security frameworks

•Oversee customer Information Security audits

Qualifications Education & Experience

•Bachelor’s degree in a relevant field or equivalent years of experience is required. Equivalent years of experience are determined as one year of technical experience for every year of college requested.

•Minimum 10 years of experience in Enterprise Information and Product Cyber security

•Strong knowledge of Secure Development Lifecycle and CI/CD automation tools (TF, Git, Jenkins)

•Knowledge of regulatory and standards-based compliance related to cloud and mobile applications, and data confidentiality (e.g., GDPR, FEDRAMP/FISMA, SOC 2, and ISO 27001, etc.)

•Experience with the application of risk identification and evaluation techniques

•Advanced knowledge of Cyber Security and full knowledge of multiple (full-stack) related engineering functions

•Preferred experience with securing cloud architectures (Azure/AWS) and/or Kubernetes

•Preferred experience leading red/blue security teams and working with engineering teams to remediate findings

Skills/Certifications

•Information Security certifications such as the Certified Information Systems Security Professional Certification (CISSP) or Certified Information Security Manager Certification (CISM) is required

•Experience with Financial services or Software-as-a-Service (SaaS) companies

MeridianLink has a wonderful culture where people value the work they do and appreciate each other for their contributions. We develop our employees so they can grow professionally by preferring to promote from within. We have an open-door policy with direct access to executives; we want to hear your ideas and what you think. Our company believes that to be productive in the long term, we must have a genuine work-life balance. We understand that employees have families and full lives outside of the office. To that end, we honor their personal commitments.

MeridianLink is an Equal Opportunity Employer. We do not discriminate based on race, religion, color, sex, age, national origin, disability, or any other characteristic protected by applicable law.

MeridianLink runs a comprehensive background check, credit check, and drug test as part of our offer process.

Salary range of $269,600 to 346,100. [It is not typical for offers to be made at or near the top of the range.] The actual salary will be determined based on experience and other job-related factors permitted by law including geographical location.

MeridianLink offers:

•Potential For Equity-Based Awards

•Insurance coverage (medical, dental, vision, life, and disability)

•Flexible paid time off

•Paid holidays

•401(k) plan with company match

•Remote work