Empirical - CISO

Employment Type
Part time

Location Type
Remote

Department
Security

Overview
Application

IMPORTANT: At the moment we are only considering candidates located in Latin America. Please do not apply if you are not located in Latin America.

About Empirical
Empirical empowers early and growth stage tech companies to create the right products in the right way by providing two pivotal services:

• Product & Technology Leadership: Our clients entrust critical decisions to our network of top-tier US-based CTOs and CPOs. We provide fractional, project, or advisory based support, combining highly experienced talent with a flexible approach.

• Product Development Teams: We provide our clients with high performing, senior product development talent through a scalable staff augmentation model and ongoing support. We focus on Latin America to find exceptional talent, with time zone and cultural compatibility.

We are proud to be a people first company, where we prioritize building meaningful, long lasting human connections with clients and team members alike, while embracing diversity and uniqueness. With this foundation and our focus on talent, we help create great products that people love.

Our values

• Care about people first

• Strive to add value always

• Lead with integrity

• Have fun every step of the way

The Opportunity
This role is with Empirical itself. We're a fully remote team of around 40–50 software engineers across Latin America, with co-founders based in San Diego. Our clients, including healthcare companies and marketing agencies serving financial-industry accounts, now contractually require written security policies consistent with FTC guidance, 24-hour breach notification, approved-subprocessor controls, cyber insurance and annual audits.

We're looking for a part-time, fractional security leader to build and maintain our security program. Our environment is lean: Google Workspace for SSO and identity, SaaS tools, GitHub and Anthropic Enterprise. We host almost no infrastructure of our own, since our engineers typically work inside client environments. Some company-issued Macs are managed with MDM, and our policies are currently informal.

The engagement starts with a gap assessment and a thin layer of policies and Workspace hardening, then grows toward SOC 2 as the business justifies it. We need someone who can phase the work sensibly rather than roll out a full enterprise program on day one.

What you'll do

• Run an initial security gap assessment across our people, tools and processes

• Draft and maintain security policies, incident response plans and risk assessments

• Harden our Google Workspace environment against the CIS benchmark

• Strengthen MFA and identity management, MDM and remote wipe, centralized logging and vulnerability management

• Prepare the company for client audits and vendor security questionnaires

• Review client MSA and security addendum language, including liability caps, breach terms and subprocessor clauses

• Define secure-coding and DevSecOps practices for engineers working in client repositories

• Build a phased roadmap toward SOC 2 that fits our size and budget

Your qualifications and experience
Must haves

• Experience helping US software development or IT services companies, such as staff augmentation firms, dev shops or consultancies, not only SaaS or enterprise companies

• Track record standing up security programs from near-zero and preparing small companies (20–100 people) for client audits and vendor questionnaires

• Hands-on experience with SOC 2 Type 2, NIST CSF and CIS Controls, and the judgment to know when a lighter framework is the right starting point

• Experience with Google Workspace hardening (CIS benchmark), MDM/remote wipe, MFA/identity management, centralized logging/SIEM and vulnerability management

• Ability to draft policies, incident response plans and risk assessments, and to review client MSA and security addendum language

• Comfortable with DevSecOps and secure-coding practices for engineers working in client repositories

• CISSP, CISM or equivalent certification

• Advanced English required.

• Familiarity with AI tools.

Nice-to-haves

• Experience with remote, distributed or LATAM-based teams

• Familiarity with HIPAA/healthcare and financial-services client requirements

• Experience working alongside fractional CTOs

What we expect from you

• 100% alignment with our core values!

• Ability to take ownership of projects from start to finish

• Strong collaboration and communication skills

• Attention to detail and a passion for delivering high-quality work

What we offer

• Remote/flexible work

• Highly competitive compensation in US dollars

• Opportunities for personal and professional development; mentorship, coaching and training as needed

• Ongoing, part-time dedication

• The opportunity to be part of an amazing, multicultural community of tech experts

Why work with us?

• We pride ourselves on our core values and have proven that putting people first creates a thriving and collaborative work environment.

• We seek to accommodate and balance individual needs with client needs, understanding each one of us is unique.

• We offer benefits such as remote/flexible work, selective paid training, mentorship programs, referral programs and more.

• We are selective in the projects we take on to ensure our teams are engaged in challenging, meaningful, enjoyable opportunities that will provoke creativity, innovation and growth!