The Senior Information Security Lead is a hands‐on senior individual contributor responsible for designing, operating, and governing Genesis Capital’s network and information security controls across a hybrid environment (Microsoft 365, Azure, AWS, and on‐prem). This role serves as the primary security control owner and internal audit gatekeeper for security‐relevant IT General Controls (ITGCs), including responsibility for SOX audit readiness, evidence quality, deficiency remediation, and risk exception governance. The position combines deep technical execution with independent judgment, strategic thinking, documentation rigor, and executive‐level communication, without managing a team.

Principal Duties:

ESSENTIAL FUNCTIONS include the following. Other duties may be assigned.

Network Security (Hands‐On Ownership)

• Design, configure, and maintain enterprise network security controls, including Palo Alto firewalls, rulebases, segmentation, and secure connectivity patterns.
• Own and operate the Netskope Zero Trust / SSE platform, including access policies, data protection rules, and monitoring.
• Define and enforce network security standards (Zero Trust principles, segmentation, logging, egress controls) and validate adherence through configuration reviews and monitoring.
• Perform regular firewall, SSE, and network control reviews to identify risk, over‐permissive access, and audit exposure.

Vulnerability & Configuration Risk Management

• Own the vulnerability management lifecycle using Qualys, including scan coverage, severity thresholds, remediation SLAs, and verification.
• Assign and track remediation actions across IT teams; independently validate closure through rescans and evidence review.
• Govern patching and hardening outcomes across infrastructure and cloud services, ensuring results meet security and audit requirements.
• Enforce security‐related change control expectations, including documentation quality and emergency change review.
• Information Security Controls & Governance
• Enforce information security policies across Microsoft 365, Azure, AWS, and on‐premise systems, translating policy into enforceable technical controls.
• Conduct security risk assessments for new systems, architecture changes, and third‐party integrations; document risks and required controls.
• Operate and continuously improve security monitoring and alerting (including SIEM tooling where applicable).
• Research emerging threats and technologies and recommend security improvements aligned to business risk.

SOX & Internal Audit Gatekeeper

• Act as the single point of contact for internal and external auditors for SOX and security‐related audits.
• Serve as named control owner for assigned security and infrastructure ITGCs, with responsibility for:
• Control design and documentation (narratives, procedures, evidence standards)
• Evidence completeness, accuracy, and timeliness
• Walkthroughs and auditor inquiries
• Deficiency analysis, remediation planning, and validation of closure
• Maintain audit‐ready documentation and evidence repositories throughout the year.

Risk Exception & Decision Authority

• Act as the security approval authority for exceptions, compensating controls, and risk acceptances.
• Document business justification, compensating controls, and expiration dates for accepted risks.
• Escalate material or systemic risks to executive leadership with clear impact analysis and recommendations.

Incident Response, DR & Resilience

• Lead technical incident response activities, including containment, root‐cause analysis, and corrective action tracking.
• Maintain incident response and disaster recovery documentation; coordinate testing, tabletop exercises, and lessons learned.

Access Governance & Security Awareness

• Conduct periodic phishing simulation testing and analyze results to drive targeted remediation.
• Conduct quarterly User Access Reviews for SOX‐scoped applications and ensur