· Cloud Security Posture: Assess, triage, and resolve Security Command Center findings across our GCP environments, hardening cloud infrastructure and configuration.
· Vulnerability Management: Review CVEs and drive remediation efforts throughout the build and runtime environments — from application dependencies and container images to the infrastructure they run on.
· Pinpointed Remediation: Turn automated scanner findings into precise code, library, and configuration change requirements that engineering teams can act on quickly.
· Security Automation: Automate the tools, services, and code build and inspection steps that take a finding from identification to resolution, reducing manual effort and time to remediate.
· CI/CD Hardening: Strengthen the security of our build pipelines and the artifacts they produce, embedding scanning and checks directly into how we ship software.
· Proactive Risk Identification: Act as the point person for security operations, spotting emerging risks early and raising them before they become incidents.
· Security Practice Leadership: Guide and evolve our security practices, standards, and tooling as Tereina grows in scale and scope.
· External Audit Leadership: Lead audits as required, including SOC 2 Type II and ISO 27001 audits end to end — scoping, readiness, evidence collection, auditor walkthroughs, and remediation of exceptions — and manage the relationship with our audit firms and coordinate internal resources.
· Internal Audit Program: Plan and run regular internal audits and control testing against SOC 2, ISO 27001, and our own policies, tracking findings through to closure.
· Auditor & Partner Point of Contact: Serve as the primary point of contact for auditors, and support security reviews, questionnaires, and due diligence from banking partners and enterprise customers.
· Controls & Evidence Automation: Own our security control framework, policies, and risk register, and automate evidence collection so we stay continuously audit-ready rather than preparing once a year.
· Cross-team Collaboration: Work with Engineering, DevOps, Compliance, and leadership across time zones to keep environments secure and embed control requirements into how we build and operate.