Chief Information Security Officer

Campfire

San Francisco, CA

On-site

Who this role is best for

Fintech or ERP professionals with security program leadership experience will find this destination role with a focus on compliance, customer trust, and AI governance.

Best fit for

Candidates with a B2B SaaS background and experience leading end-to-end SOC 1/SOC 2 audits
— “Has owned SOC 1 / SOC 2 audits end to end.”
Individuals who can build security programs from the ground up and scale with the company
— “Pragmatic builder: starts as a team of one, hires as we grow.”
Professionals with hands-on technical experience in AWS, Okta, and SIEM/EDR tools
— “Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.”

Things to consider

The role requires direct engagement with enterprise CIOs and auditors, which may demand strong interpersonal and communication skills.
— “Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.”
Candidates must be prepared to take ownership of AI security governance and vendor oversight.
— “Govern AI vendors and subprocessors.”
The Bay Area location preference may limit options for remote candidates.
— “Location: Bay Area preferred.”

How to stand out

Highlight experience with AI security frameworks and customer-facing security reviews.
— “Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.”
Demonstrate leadership in incident response and breach notification processes.
— “Own customer breach notification decisions and post-incident write-ups.”
Emphasize experience with Vanta and ISO 27001/42001 certification processes.
— “Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.”
Demonstrate expertise in privacy frameworks like GDPR and contract security terms.
— “Working knowledge of GDPR, DPAs and contract security terms.”

Pace · SteadyCollaboration · HighAutonomy · HighDecision Impact · Company

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

own SOC 1 and SOC 2 audits
lead incident response

Typical background

Information SecurityCompliance

Skills & requirements

Required

Security OperationsIncident ResponseCompliancePrivacyContracts

Preferred

AI SecurityERP

Stack & domain

SecurityComplianceCustomer TrustSecurity QuestionnairesTprmsRfpsSIGCAIQSOC 1SOC 2ISO 27001ISO 42001VantaDORAGDPRBCDRIncident ResponseEmail SecurityOktaPhishing-resistant MFASCIMMDMLeast-privilege AccessAWSGoogle WorkspaceEDRSIEMAI SecurityAI AssistantPrompt And Response RetentionLoggingOpt-outAI VendorsSubprocessorsBCDR PlansRto/rpo TargetsBackup And Restore TestingInformation SecurityResponsible AIVendor ManagementBackground And Sanctions ScreeningEmployee And VendorCommunicationProblem-solvingDecision-makingCustomer CommunicationTeam ManagementERPFinancial AutomationAi-native Platform

About the role

Original posting from Campfire via Ashby

About Campfire
Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an AI-native platform that helps finance teams move faster and operate more efficiently.
The role
Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises.
Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital.
Customers trust us with their general ledger, bank details, payroll and vendor data.
Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews.
You will turn that into an in-house program that closes deals faster and keeps us safe.
WHAT YOU'LL OWN
Customer security reviews and deal support
Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.
Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.
Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.
Compliance and audits
Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.
Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.
Run Vanta as the system of record for controls and evidence.
Privacy and contracts
Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.
Review security and audit-cooperation clauses in customer contracts.
Own data retention, export and residency answers, including new-region or GovCloud requests.
Security operations and incident response
Own the incident response plan, run tabletop tests, and lead response when incidents happen.
Own customer breach notification decisions and post-incident write-ups.
Own detection and email security: SIEM, EDR, email protection, identity alerting.
Identity and access
Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production.
Support customer-facing SSO/SCIM setups.
Resilience and policy
Own BCDR plans, RTO/RPO targets, backup and restore testing.
Maintain information security, responsible AI and vendor management policies.
Run background and sanctions screening for employees and vendors.
AI security
Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out.
Govern AI vendors and subprocessors.
FIRST 90 DAYS
Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales.
Finish the Vanta migration and publish a trust center with standard collateral.
Finalize and test the BCDR and incident response plans.
Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage.
Present a 12-month security and certification roadmap to the CTO.
WHAT WE'RE LOOKING FOR
10+ years in security, with 3+ leading a program at a B2B SaaS company.
Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.
Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.
Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.
Working knowledge of GDPR, DPAs and contract security terms.
Has led real incident response, including customer communication.
Fintech, ERP or accounting software background a strong plus.
Pragmatic builder: starts as a team of one, hires as we grow.
REPORTING AND LOGISTICS
Reports to the CEO. Works closely with Sales, Legal and Engineering.
Location: Bay Area preferred.

Source: Campfire careers (Ashby)