# Chief Information Security Officer at Campfire

Chief Information Security Officer at Campfire in San Francisco. On-site, full-time. Posted October 13, 2026.

- Company: Campfire
- Location: San Francisco
- Workplace: On-site
- Job type: Full-time
- Experience: 10+ years
- Posted: 2026-10-13
- Apply: https://jobs.ashbyhq.com/campfire/b98a00a5-35ff-42e2-bc98-bda01d1a4132/application
- Source: https://jobmagic.ai/jobs/chief-information-security-officer-campfire-xx9c3k

## Requirements

- 10+ years in security, with 3+ leading a program at a B2B SaaS company.
- Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.
- Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.
- Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.
- Working knowledge of GDPR, DPAs and contract security terms.
- Has led real incident response, including customer communication.
- Fintech, ERP or accounting software background a strong plus.
- Pragmatic builder: starts as a team of one, hires as we grow.

## Description

**About Campfire**

Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an AI-native platform that helps finance teams move faster and operate more efficiently.

**The role**
Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises.

- Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital.

- Customers trust us with their general ledger, bank details, payroll and vendor data.

- Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews.

- You will turn that into an in-house program that closes deals faster and keeps us safe.

### **What you'll ownCustomer security reviews and deal support**

- Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.

- Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.

- Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.

**Compliance and audits**

- Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.

- Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.

- Run Vanta as the system of record for controls and evidence.

**Privacy and contracts**

- Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.

- Review security and audit-cooperation clauses in customer contracts.

- Own data retention, export and residency answers, including new-region or GovCloud requests.

**Security operations and incident response**

- Own the incident response plan, run tabletop tests, and lead response when incidents happen.

- Own customer breach notification decisions and post-incident write-ups.

- Own detection and email security: SIEM, EDR, email protection, identity alerting.

**Identity and access**

- Own Okta (SSO, phishing-resistant MFA, SCIM), MDM and least-privilege access to production.

- Support customer-facing SSO/SCIM setups.

**Resilience and policy**

- Own BCDR plans, RTO/RPO targets, backup and restore testing.

- Maintain information security, responsible AI and vendor management policies.

- Run background and sanctions screening for employees and vendors.

**AI security**

- Answer customer questions on our AI assistant: underlying models, prompt and response retention, logging, and opt-out.

- Govern AI vendors and subprocessors.

### **First 90 days**

- Take over customer security reviews from the vCISO firm and set a clear intake and turnaround process for Sales.

- Finish the Vanta migration and publish a trust center with standard collateral.

- Finalize and test the BCDR and incident response plans.

- Close out post-incident hardening: email security, Okta alerting, MDM and EDR coverage.

- Present a 12-month security and certification roadmap to the CTO.

### **What we're looking for**

- 10+ years in security, with 3+ leading a program at a B2B SaaS company.

- Has owned SOC 1 / SOC 2 audits end to end. ISO 27001 experience a plus.

- Comfortable on calls with enterprise CIOs and auditors, and enjoys helping close deals.

- Hands-on with AWS, Okta, Google Workspace, EDR and SIEM tooling.

- Working knowledge of GDPR, DPAs and contract security terms.

- Has led real incident response, including customer communication.

- Fintech, ERP or accounting software background a strong plus.

- Pragmatic builder: starts as a team of one, hires as we grow.

### **Reporting and logistics**

- Reports to the CEO. Works closely with Sales, Legal and Engineering.

- Location: Bay Area preferred.