Overview

Application

IMPORTANT: At the moment we are only considering candidates located in Latin America. Please do not apply if you are not located in Latin America.

About Empirical

Empirical empowers early and growth stage tech companies to create the right products in the right way by providing two pivotal services:

Product & Technology Leadership: Our clients entrust critical decisions to our network of top-tier US-based CTOs and CPOs. We provide fractional, project, or advisory based support, combining highly experienced talent with a flexible approach.

Product Development Teams: We provide our clients with high performing, senior product development talent through a scalable staff augmentation model and ongoing support. We focus on Latin America to find exceptional talent, with time zone and cultural compatibility.

We are proud to be a people first company, where we prioritize building meaningful, long lasting human connections with clients and team members alike, while embracing diversity and uniqueness. With this foundation and our focus on talent, we help create great products that people love.

Our values

Care about people first

Strive to add value always

Lead with integrity

Have fun every step of the way

The Opportunity

This role is with Empirical itself. We're a fully remote team of around 40–50 software engineers across Latin America, with co-founders based in San Diego. Our clients, including healthcare companies and marketing agencies serving financial-industry accounts, now contractually require written security policies consistent with FTC guidance, 24-hour breach notification, approved-subprocessor controls, cyber insurance and annual audits.

We're looking for a fractional security leader to build and maintain our security program. Our environment is lean: Google Workspace for SSO and identity, SaaS tools, GitHub and Anthropic Enterprise. We host almost no infrastructure of our own, since our engineers typically work inside client environments. Some company-issued Macs are managed with MDM, and our policies are currently informal.

The engagement starts with a gap assessment and a thin layer of policies and Workspace hardening, then grows toward SOC 2 as the business justifies it. We need someone who can phase the work sensibly rather than roll out a full enterprise program on day one.

What you'll do

Run an initial security gap assessment across our people, tools and processes

Draft and maintain security policies, incident response plans and risk assessments

Harden our Google Workspace environment against the CIS benchmark

Strengthen MFA and identity management, MDM and remote wipe, centralized logging and vulnerability management

Prepare the company for client audits and vendor security questionnaires

Review client MSA and security addendum language, including liability caps, breach terms and subprocessor clauses

Define secure-coding and DevSecOps practices for engineers working in client repositories

Build a phased roadmap toward SOC 2 that fits our size and budget

Your qualifications and experience

Must haves

Experience helping US software development or IT services companies, such as staff augmentation firms, dev shops or consultancies, not only SaaS or enterprise companies

Track record standing up security programs from near-zero and preparing small companies (20–100 people) for client audits and vendor questionnaires

Hands-on experience with SOC 2 Type 2, NIST CSF and CIS Controls, and the judgment to know when a lighter framework is the right starting point

Experience with Google Workspace hardening (CIS benchmark), MDM/remote wipe, MFA/identity management, centralized logging/SIEM and vulnerability management

Ability to draft policies, incident response plans and risk assessments, and to review client MSA and security addendum language

Comfortable with DevSecOps and secure-coding practices for engineers working in client repositories

CISSP, CISM or equivalent certification

Advanced English required.

Familiarity with AI tools.

Empirical - Fractional CISO