Director, Security & Compliance

免费注册后解锁"你的匹配分 vs 高分画像"与个人技能缺口。

Who we are: MHC is a global provider of AI-powered SaaS solutions for document, communication, and payment automation - purpose-built for highly regulated industries. We simplify complexity and unlock intelligence so organizations can deliver exceptional experiences with confidence. Our platform helps enterprise and mid-market organizations improve efficiency, ensure compliance, and modernize customer communications at scale. Customers use MHC solutions to generate more than 10 billion documents and process billions in AP payments annually. Recognized as a Leader in multiple G2 reports and featured in analyst reports from Gartner, IDC, Aspire, and Aragon, MHC is built for organizations that can't afford to get it wrong. People are at the center of everything we do - for our customers and within our own walls. MHC supports a flexible, work-where-you-live model, and for five consecutive years has been named one of Minnesota's Top Workplaces by the Star Tribune, based entirely on employee feedback. We are a team driven to grow, committed to being better than yesterday, and stronger together. We earn trust every day with our customers, our partners, and each other. We experiment boldly, and when our customers win, we win. For more information, visit mhcautomation.com. Who we are looking for: We are seeking a hands-on Director, Security and Compliance to build and own our security, data governance, and AI governance program as we scale. This is a rare "own it end to end" role. You won't be managing a large team or inheriting a mature GRC function. You'll be the single point of accountability for keeping customer trust, data, and AI systems secure and audit-ready, while working shoulder to shoulder with engineering, product, and sales. This role sits at the intersection of three disciplines that are converging fast in AI-native companies: security compliance (SOC 2 and beyond), data governance, and AI governance/risk. You'll set the strategy and also do the work writing policies, running access reviews, managing auditors, and answering enterprise security questionnaires. This is also a certification-critical role. Maintaining our SOC 2 Type II report is a top-priority. What you will get to do: Security Compliance Program Own the renewal and continuous operation of our SOC 2 Type II report and serve as primary liaison to our audit firm Mature the existing control environment: reduce manual evidence collection, tighten scope as new products/systems come online, and keep controls audit-ready year-round rather than sprinting before each renewal Develop, document, and operate controls that maximize risk mitigation and remain compliant with our target regulatory frameworks (SOC 2 Type II, HIPAA, PCI, GDPR/CCPA), and work directly with auditors to ensure ongoing compliance Expand our attestation footprint as needed based on customer and market demand (ISO 27001, HIPAA, GDPR/CCPA, or SOC 2 + additional Trust Services Criteria like Privacy) Serve as the primary point of contact for customer security reviews, questionnaires, and due-diligence requests during the sales cycle Maintain the company's security policy suite, risk register, and incident response plan; run tabletop exercises Data Governance Establish data classification, retention, and access-control standards across production systems, data warehouses, and SaaS tools Partner with engineering to implement least-privilege access, encryption standards, and data lifecycle management Develop and implement secure software development lifecycle (SDLC) policies in partnership with engineering, along with environmental and physical security standards Own vendor/third-party risk management, including security review of new SaaS and AI tools before adoption Assist Legal with customer and vendor contractual negotiations related to security and data privacy obligations AI Governance Risk Build the company's AI governance framework: acceptable use policies, model/vendor risk assessment, and overs

我们是谁：MHC是一家全球性提供商，专注于为文档、通信和支付自动化提供AI驱动的SaaS解决方案——专为高度监管行业量身打造。我们简化复杂性并释放智能，使组织能够自信地交付卓越体验。我们的平台帮助企业及中端市场组织提升效率、确保合规，并大规模现代化客户通信。客户使用MHC解决方案每年生成超过100亿份文档，并处理数十亿美元的AP付款。MHC在多个G2报告中被评为领导者，并出现在Gartner、IDC、Aspire和Aragon的分析师报告中，专为那些无法承受出错的组织而构建。人是我们一切工作的核心——对我们的客户以及在我们内部都是如此。MHC支持灵活的工作地点模式，并连续五年被Star Tribune评为明尼苏达州最佳工作场所之一，完全基于员工反馈。我们是一个 driven to grow、致力于比昨天更好、团结更强大的团队。我们每天赢得客户、合作伙伴和彼此的信任。我们大胆实验，当客户赢时，我们就赢。欲了解更多信息，请访问mhcautomation.com。我们正在寻找：我们正在寻找一位 hands-on 的安全与合规总监，随着我们的扩展，构建并拥有我们的安全、数据治理和AI治理项目。这是一个罕见的“端到端拥有”角色。你不会管理一个大团队或继承一个成熟的GRC职能。你将是唯一负责保持客户信任、数据和AI系统安全且审计就绪的问责点，同时与工程、产品和销售并肩工作。这个角色位于三个学科的交汇处，这些学科在AI原生公司中快速融合：安全合规（SOC 2及更高）、数据治理和AI治理/风险。你将制定战略，同时也做实际工作——编写政策、运行访问审查、管理审计师并回答企业安全问卷。这也是一个认证关键角色。维护我们的SOC 2 Type II报告是首要任务。你将有机会做：安全合规项目 拥有我们SOC 2 Type II报告的续期和持续运营，并作为我们审计公司的主要联络人 成熟现有控制环境：减少手动证据收集，随着新产品/系统上线收紧范围，并保持控制全年审计就绪，而不是在每次续期前冲刺 开发、记录和运营最大化风险缓解并保持符合我们目标监管框架（SOC 2 Type II、HIPAA、PCI、GDPR/CCPA）的控制，并直接与审计师合作以确保持续合规 根据客户和市场需求扩展我们的认证足迹（ISO 27001、HIPAA、GDPR/CCPA或SOC 2 + 额外信任服务标准如隐私） 作为销售周期中客户安全审查、问卷和尽职调查请求的主要联系人 维护公司安全政策套件、风险登记册和事件响应计划；运行桌面演练 数据治理 在生产系统、数据仓库和SaaS工具中建立数据分类、保留和访问控制标准 与工程合作实施最小权限访问、加密标准和数据生命周期管理 与工程合作开发和实施安全软件开发生命周期（SDLC）政策，以及环境和物理安全标准 拥有供应商/第三方风险管理，包括在采用前对新SaaS和AI工具进行安全审查 协助法律部门处理与安全和数据隐私义务相关的客户和供应商合同谈判 AI治理风险 构建公司的AI治理框架：可接受使用政策、模型/供应商风险评估和监

⚑ 岗位信息收录自公开招聘页（Himalayas），以雇主官网为准