Chief Information Security Officer

About Campfire Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an AI-native platform that helps finance teams move faster and operate more efficiently. The role Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises. - Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital. - Customers trust us with their general ledger, bank details, payroll and vendor data. - Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews. - You will turn that into an in-house program that closes deals faster and keeps us safe. WHAT YOU'LL OWN Customer security reviews and deal support - Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround. - Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs. - Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate. Compliance and audits - Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions. - Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about. - Run Vanta as the system of record for controls and evidence. Privacy and contracts - Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws. - Review security and audit-cooperation clauses in customer contracts. - Own data retention, export and residency answers, including new-region or GovCloud requests. Security operations and incident response - Own the incident response plan, run tabletop tests, and lead response when incidents happen. - Own customer breach notification decisions and post-incident write-ups. - Own detection and email security: SIEM, EDR, email protection, identity alerting. Identity and access - Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production. - Support customer-facing SSO/SCIM setups. Resilience and policy - Own BCDR plans, RTO/RPO targets, backup and restore testing. - Maintain information security, responsible AI and vendor management policies. - Run background and sanctions screening for employees and vendors. AI security - Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out. - Govern AI vendors and subprocessors. FIRST 90 DAYS 1. Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales. 2. Finish the Vanta migration and publish a trust center with standard collateral. 3. Finalize and test the BCDR and incident response plans. 4. Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage. 5. Present a 12-month security and certification roadmap to the CTO. WHAT WE'RE LOOKING FOR - 10+ years in security, with 3+ leading a program at a B2B SaaS company. - Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus. - Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals. - Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling. - Working knowledge of GDPR, DPAs and contract security terms. - Has led real incident response, including customer communication. - Fintech, ERP or accounting software background a strong plus. - Pragmatic builder: starts as a team of one, hires as we grow. REPORTING AND LOGISTICS - Reports to the CEO. Works closely with Sales, Legal and Engineering. - Location: Bay Area preferred.