Foley is modernizing its technology infrastructure and expanding the use of AI across the business. We're looking for a hands-on Manager of IT Security to lead our security operations, strengthen our security posture, and proactively identify and address risks.
You'll manage one security engineer while remaining deeply involved in technical execution. This role requires someone who takes initiative, brings forward clear recommendations, and drives security improvements to completion. You'll partner closely with Infrastructure, Engineering, our AI team, and business stakeholders to protect Foley while enabling innovation.
Cloud & Identity Security: Lead security improvements across AWS, including IAM, multi-account governance, networking, and security monitoring. Manage identity and access controls through Microsoft Entra ID, Conditional Access, SSO/SCIM, and privileged access management.
Endpoint & Security Operations: Maintain and strengthen endpoint security, patching, EDR coverage, and security monitoring across our managed fleet. Optimize existing security tools, including Rapid7, Intune, NinjaOne, and related platforms.
Vulnerability Management & Incident Response: Own vulnerability management from detection and prioritization through remediation. Lead incident response, coordinate with our MDR provider, and drive corrective actions that reduce future risk.
AI Security: Partner with our AI and Engineering teams to secure AI tools, agents, and integrations. Implement practical guardrails for data protection, access permissions, non-human identities, and responsible AI adoption.
Security Compliance & Audits: Own Foley's SOC 2 Type II audit process end to end, including security controls, evidence collection, audit readiness, remediation, and direct coordination with external auditors. Maintain PCI DSS compliance requirements and support security policies and vendor risk assessments.
Secure Engineering: Partner with Engineering to strengthen security across development environments, CI/CD pipelines, source control, and application integrations.
Security Roadmap & Continuous Improvement: Proactively monitor emerging threats, evaluate security risks, and drive improvements. Develop and execute a prioritized security roadmap in partnership with the Director of Infrastructure.
Team Leadership & Collaboration: Manage and develop a security engineer while partnering across Infrastructure, Engineering, Compliance, Legal, and business teams to strengthen security practices and support business priorities.
7+ years of information security experience, including experience leading security initiatives or programs and managing or formally leading security professionals.
Strong hands-on AWS security experience, including IAM, multi-account governance, network security, and AWS-native security services such as GuardDuty, Security Hub, and CloudTrail.
Deep experience with Microsoft Entra ID, Conditional Access, SSO/federation, privileged access, and identity lifecycle management.
Demonstrated experience with endpoint security, vulnerability management, incident response, and MDR/SOC partnerships.
Proven experience owning SOC 2 Type II audits end to end, including control implementation, evidence collection, audit coordination, and remediation.
Working knowledge of AI security risks, including data leakage, over-privileged agents, non-human identities, and secure AI integrations.
A proactive approach to identifying risks, recommending solutions, and driving improvements independently, with strong communication skills across technical and business audiences.
Experience with PCI DSS and security frameworks such as NIST CSF, ISO 27001, and CIS Controls.
Relevant certifications such as CISSP, CCSP, AWS Certified Security – Specialty, or Microsoft SC-series.
Scripting, automation, or infrastructure-as-code experience.
Experience securing a distributed workforce in a lean or regulated environment.
Location: This role is primarily remote (US based) and will work in primarily EST hours, with the expectation of occasional visits to our offices for team collaboration, training, or company events.
This role may be based remotely out of the following states: Arizona, California, Colorado, Connecticut, Florida, Georgia, Illinois, Indiana, Kansas, Massachusetts, Maryland, Michigan, Missouri, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Virginia, Wisconsin
At Foley, we’re reimagining how safety-sensitive industries hire, stay compliant, and manage risk. We’ve evolved into a modern SaaS company with an all-in-one, AI-ready platform that helps transportation, construction, distribution, and utility businesses operate faster, smarter, and safer.
As we continue to grow, we’re looking for curious, strategic thinkers who thrive in complexity, are motivated by making an impact, and want to join a team that’s passionate about building great products and supporting customers. Our core values — Teammateship, Grit, and Innovation — guide everything we do. Whether we’re collaborating internally or helping customers, we approach every challenge with optimism, humor, and a shared commitment to success.
Benefits
Foley offers a comprehensive benefits package that includes medical, dental, and vision coverage, a 401(k) with company match, paid time off and holidays, wellness programs, and an employee assistance program.
Equal Employment Opportunity
Foley is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity or expression, national origin, age, disability, protected veteran status, or any other legally protected characteristic.
Reasonable Accommodations
If you require a reasonable accommodation during the application or interview process, please contact us at careers@foley.io
Employment Status
Employment with Foley is on an at-will basis. Nothing in this job posting or in future communications should be construed as a contract of employment.
Massachusetts Applicants: It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
Privacy Policy: Please see our Applicant Privacy Policy for more information on how Foley processes your personal information during the recruitment process and, if applicable based on your location, how you can exercise any privacy rights.