About the Role We are looking for a senior, execution-focused Lead to own production release management, change control, and security and compliance operations. This role is about owning the day-to-day: getting changes out safely, keeping SOC 2 evidence current, and running hands-on security operations. This is a hands-on delivery role. Strategic and cross-company leadership responsibilities — roadmap ownership, architecture review boards, and mentoring — remain with existing leadership and are not part of this position. Key Responsibilities - Own production release and deployment pipelines (Octopus Deploy and TeamCity), including zero-downtime deployment practices and resolving stuck or failed deployments. - Approve production changes, hotfixes, and feature toggle changes, and schedule maintenance windows with appropriate customer notice through the status page. - Own SOC 2 change management and audit evidence collection, working directly with external auditors through full SOC 2, HIPAA, or PCI audit cycles. - Run hands-on security operations: vulnerability and patch remediation tracking, endpoint security tooling, and triage of externally reported vulnerabilities. - Administer identity and access management — access reviews, MFA, privileged access controls, and granting or revoking production access to databases, VPN, and deployment tooling. - Support customer-facing security questionnaires and the security sections of RFPs. - Handle the monthly flow of infrastructure and access tickets that require change approval or production access grants. - Be available for occasional on-call and off-hours support when production needs it. Must-Have Requirements - 8+ years of total infrastructure or release engineering experience. - 5+ years directly owning production release and deployment pipelines, including rollback practices. - 5+ years owning SOC 2 (or equivalent) change management and audit evidence processes. - 5+ years of hands-on security operations experience. - Identity and access management administration experience, including access reviews and privileged access controls. - Experience supporting customer-facing security questionnaires or RFP security sections. - Experience working directly with external auditors through at least one full audit cycle. Nice to Have - AWS security experience: IAM, security groups, CloudTrail. - Familiarity with vulnerability disclosure programs (HackerOne, Bugcrowd) or coordinating third-party penetration tests. - GRC or compliance tooling experience (Vanta, Drata, or similar). - Experience with customer trust or security review platforms (Conveyor, CSA STAR). - Prior experience at a SaaS company serving regulated industries. What We're Looking For Beyond Skills - Comfortable being the person who says no to a change that isn't ready — even under pressure — and just as comfortable explaining exactly why, so the requester is never left guessing. - High ownership and a calm, structured approach to production incidents and failed releases. - Clear, precise communication with engineering teams, auditors, and customer security teams. - Strong attention to detail and a disciplined approach to documentation and evidence. *If you take pride in shipping changes safely and keeping security and compliance airtight in production, we'd love to hear from you.*