The posting
ABOUT SOFAR OCEAN
Sofar Ocean is building the world's largest real-time ocean sensor network. Our Spotter buoys collect ocean data across the globe, and our software, including Wayfinder for voyage optimization, turns that data into decisions for commercial shipping, government, and defense customers. We're a team of about 100 based at Pier 28 in San Francisco, and we're growing fast.
ABOUT THE ROLE
You’ll own Sofar’s corporate security and identity infrastructure and lead our security compliance program. You’ll turn security priorities into working controls, and be the internal point person for customer security reviews. Helpdesk and facilities IT are handled by our managed IT partner, whom you’ll work alongside.
WHAT YOU’LL DO
- Identity and access: own Google Workspace as our identity provider. Roll out SSO and SCIM provisioning across our SaaS tools, automate joiner/mover/leaver processes, and run periodic access reviews.
- Endpoints: own device management (MDM, EDR) and endpoint detection and response, including device compliance policies.
- Security operations: tune and triage SIEM detections. Track vulnerability remediation across Dependabot findings and pen test results. Maintain and exercise our incident response plan.
- Compliance: run day-to-day work toward SOC 2 and other compliance processes. That includes maintaining policies, operating our compliance platform, collecting audit evidence, and reviewing vendors and subprocessors.
- Customer trust: own responses to customer security questionnaires and assessments. Keep our answers accurate, consistent, and defensible.
- Vendors: manage day-to-day relationships with our managed IT provider, security vendors and advisors, contractors, and auditors.
WHAT YOU BRING
- 5+ years in IT systems, corporate security, or security engineering, ideally at a startup
- A clear, well-reasoned point of view on how a ~100-person startup should approach security, including where to invest early, where to accept risk, and how to sequence compliance work. You can defend that view and adjust it when the context changes.
- Hands-on administration of Google Workspace and an SSO/SCIM stack, plus MDM and EDR tooling
- Working knowledge of AWS IAM. Scripting ability in Python or similar for automation.
- Has been through at least one SOC 2 or ISO 27001 audit from the inside
- Writes clearly and precisely. You prefer a defensible claim to an optimistic one.
NICE TO HAVE
- Experience Vanta or Drata, AWS CloudFormation, Auth0
- experience with SIEM detection engineering
LOCATION, COMPENSATION, & BENEFITS
- The preference is for this role is based at our Pier 28 office in San Francisco a few days a week to work seamlessly with our team. However, we are open to remote applicants.
- The base salary range for this role is $150,000 to $200,000, plus equity. Final pay depends on experience and skills. We offer medical, dental, and vision coverage, 401(k), flexible PTO, and a learning and development stipend.
- The range listed is what we reasonably expect to pay for this role at the time of this posting. We may ultimately pay more or less than the posted range and may be modified in the future. Actual compensation packages are based on several factors that are unique to each candidate, including but not limited to skill set, experience, and equity package.
OUR APPROACH TO AI IN THE HIRING PROCESS:
At Sofar, we use AI tools in our day-to-day work, and we don't expect our hiring process to be any different. Here's how we think about it:
Applying: Write your own first draft — we want to hear your voice and understand your real experience. AI is fine for refining and polishing, not for generating your story.
Take-home assessments: Complete these on your own unless we've explicitly said otherwise. We'll always be upfront about it when AI is allowed.
Interview prep: Go for it. Use AI to research Sofar, practice your responses, and sharpen your thinking before we meet.
During interviews: This is you. We're a small team and we move fast — live conversations are how we get to know you, and we're genuinely curious how you think in real time.
A note on transparency: We're a lean People team, and we use AI to help with things like drafting job descriptions, preparing interview questions, and candidate communications. We don't use it to make hiring decisions — those are always ours.
The through line: use AI to show more of yourself, not less :)
Visa sponsorship: We do sponsor visas and retain an immigration lawyer to support the process. While we can't guarantee sponsorship for every role or situation, if we make you an offer, we'll make every reasonable effort to make it work.
A note on applying: We mean it when we say we want the strongest people — not the most credentialed ones. If you're excited about this work but don't check every box, please apply anyway. Research consistently shows that underrepresented candidates are more likely to self-select out, and that's a loss for everyone. Sofar operates at the intersection of ocean science, climate, and technology — the problems we're solving are consequential, and the perspectives we bring to them matter. We're actively working to build a team that reflects that.
Sofar Ocean is an equal opportunity employer. We welcome applicants of all backgrounds and do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other protected characteristic.
