Fractional CISO
Summary
Fractional (20-30 hrs/week) remote vCISO for Arcanys, a software outsourcing firm. Day to day: build the security program - SOC 2 Type 2 / ISO 27001 policies and controls, risk register, GDPR and cross-border privacy compliance, incident response and BCP/DR, and a lean toolstack (EDR, SIEM, vulnerability scanners).
About Arcanys
Arcanys launched in 2010 to help entrepreneurs and innovators from Australia, Europe and other parts of the globe accelerate their software development with dedicated remote engineers from the Philippines.
Why work with us?
There’s a unique spirit to Arcanys—manifested in our amazing talents, passion for technology, and a strong focus on everyone’s career and personal development. As a company rooted in people, we make a point to offer exciting work opportunities and foster a culture that everyone can meaningfully contribute to.
Join us as a: Fractional CISO (vCISO)
Location: Remote
Engagement: Fractional (20-30 hours/week)
Key Responsibilities
1. Security Strategy
Develop procedures, policies, work instructions to fulfill the controls from SOC2Type2 and ISO27001
Design a 12-month security roadmap that balances "Swiss Quality" expectations with the agility of a software outsourcing firm.
Establish a Risk Register and prioritize remediation based on business impact.
2 . Cross-Border Compliance
Ensure all data handling meets the European GDPR, the Philippines Data Privacy Act and the Australian Privacy Act standards, among other regulations.
Standardize our response to client security questionnaires to accelerate the sales cycle.
3. Incident & Policy Management
Draft and implement core policies (Incident Response, Access Control, BCP/DR) that are practical, not just theoretical.
Oversee the selection and implementation of essential security tools (EDR, SIEM, Vulnerability Scanners) without over-complicating the stack.
Who You Are (Requirements)
Proven experience leading security governance in mid-sized companies (200–500 employees), including SOC 2 Type2 or ISO 27001 certification, ideally in outsourcing/software services companies.
Strong technical foundation across SDLC, CI/CD security, and cloud platforms (AWS, Google Workspace).
Effective communicator and mentor, able to explain security concepts to both junior technical staff and non-technical stakeholders.
Experience handling client security audits and vendor assessments.
Experience working with distributed teams (Europe/Asia/Australia) and with early-stage startups is a plus.
Relevant certifications such as CISSP, CISM, or CISA preferred.