About this opportunity
Sprites lists this Chief Information Security Officer opportunity in san francisco, California. Review the employer’s description below for duties, qualifications and application requirements.
Job description
About Campfire
Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an AI-native platform that helps finance teams move faster and operate more efficiently.
The role
Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises.
Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital.
Customers trust us with their general ledger, bank details, payroll and vendor data.
Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews.
You will turn that into an in-house program that closes deals faster and keeps us safe.
What you'll own
Customer security reviews and deal support
Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.
Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.
Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.
Compliance and audits
Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.
Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.
Run Vanta as the system of record for controls and evidence.
Privacy and contracts
Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.
Review security and audit-cooperation clauses in customer contracts.
Own data retention, export and residency answers, including new-region or GovCloud requests.
Security operations and incident response
Own the incident response plan, run tabletop tests, and lead response when incidents happen.
Own customer breach notification decisions and post-incident write-ups.
Own detection and email security: SIEM, EDR, email protection, identity alerting.
Identity and access
Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production.
Support customer-facing SSO/SCIM setups.
Resilience and policy
Own BCDR plans, RTO/RPO targets, backup and restore testing.
Maintain information security, responsible AI and vendor management policies.
Run background and sanctions screening for employees and vendors.
AI security
Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out.
Govern AI vendors and subprocessors.
First 90 days
Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales.
Finish the Vanta migration and publish a trust center with standard collateral.
Finalize and test the BCDR and incident response plans.
Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage.
Present a 12-month security and certification roadmap to the CTO.
What we're looking for
10+ years in security, with 3+ leading a program at a B2B SaaS company.
Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.
Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.
Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.
Working knowledge of GDPR, DPAs and contract security terms.
Has led real incident response, including customer communication.
Fintech, ERP or accounting software background a strong plus.
Pragmatic builder: starts as a team of one, hires as we grow.
Reporting and logistics
Reports to the CEO. Works closely with Sales, Legal and Engineering.
Location: Bay Area preferred.
#J-18808-Ljbffr
Worksite address
san francisco, CA, 94199, US
Who can apply
Review the original listing for work authorization, qualifications and employer requirements.