Chief Security and Privacy Officer

Location: Slovenia

Department: Engineering

Who We Are

At Viaduct, we are developing an Asset Performance Management system used by Manufacturers and Vehicle Fleet Operators. The foundation of our products is a platform that hosts diverse data sources, including high-volume sensor and fault iOT data being generated by the devices. We also incorporate many other types of data, including MES data, test data, asset attribute data, warranty claim data, and inspection data. We have machine learning algorithms, anomaly detection algorithms, clustering algorithms and many other algorithms that support the type of analytics that help customers identify problems quickly and do root cause analysis. We have two SAAS products, built from a common codebase. One is focused on Manufacturers, and one is focused on Fleet Operators.

Our applications are deployed in AWS in an EKS cluster. We use Postgres for application state and transactional data, and Clickhouse Cloud as our analytics database. Our applications are TypeScript / React on the front end with REST APIs implemented in Go on the back end. Many of our data processing pipelines are implemented in Python.

We have successfully completed four SOC 2 audits for Security, Availability, and Confidentiality with no exceptions. Our audits are annual, and completed at the end of the first calendar quarter of the year.

Who You Are

You are an experienced Security leader who has a track record of defining and executing security policies and successfully passing security audits. You are responsible for making sure that the data collected for audits is complete and accurate. You understand the concepts behind SOC 2 and ISO 27001, and can help the company navigate audits, including audits for new standards such as ISO 42001.

Expected Skills

• 3+ years as an Chief Security Officer
• Experience with audited security frameworks such as SOC 2 and ISO 27001
• Track record of successful Security audits
• Excellent spoken and written communication skills
• Working knowledge of distributed/cloud compute platforms (AWS, Azure, GCP, etc.)
• Ability to drive progress under tight deadlines
• Self-motivated and with a bias towards action

Security and Privacy Responsibilities

• Responsible for the Security posture of the company
• Responsible for compliance with US and International Privacy laws
• Security Team Member
• Privacy Team Member
• Provide Security and Privacy education and awareness training for new employees,
• Provide annual Security and Privacy awareness training for all employees
• Annually review, and update Security and Privacy Policies as necessary
• Responsible for Internal and external communication related to breaches, and security incidents
• Ensure that data collected for the Security and Privacy audits is complete and accurate
• Manage a constructive and collaborative relationship with our Security auditors
• Lead internal Security meetings required to support Security and/or Privacy audits
• Lead the audit meetings with our Security auditors
• Package security materials for customer review on demand or by implementing a Trust Portal
• Do security reviews for new sub-processors
• Do the annual Security review for all sub-processors
• Approve the license agreements for open source software used in our application
• Follow our policy and procedure documents related to security and privacy
• Follow the guidelines in the Employee Handbook
• Treat data security and privacy as one of your primary job responsibilities
• Report Security Incidents you discover or learn about as bugs in Jira
• Explicitly consider security implications when doing PR reviews

• Perform the Duties of Chief Privacy Officer
• Perform the Duties of Data Protection Officer
• Respond to Data Subject Requests
• Ensure that international customer contacts comply with US and International Privacy laws

• Responsible for awareness and compliance with US and International Privacy laws
• Conduct Privacy Impact Assessments (PIAs) as required by contracts
• Conduct Data Protection Impact Assessments (DPIAs) as required by contracts