Portfolio company compliance

• Own the security baseline for each portfolio company (a primary responsibility of this role). After an acquisition closes, support implementation of the CISO's initial analysis, then transition it into the company's security baseline and run the scheduled, recurring baseline reviews from there.
• Work directly with each portfolio company's leadership and IT teams to assess and track compliance with the required framework.
• Run framework gap assessments at each company and help build practical remediation plans.
• Manually collect compliance data and evidence from each portfolio company, and track each company's status and open remediation items, and report progress to Bertram Labs leadership.
• Share policy templates, control guidance, and best practices so portfolio companies don't start from scratch.
• Help each portfolio company establish its own third-party vendor due diligence program, including the process, templates, and review criteria. Each company runs its own reviews.

SOC 2 compliance

• Coordinate SOC 2 readiness, the Type I audit, and ongoing Type II audit periods against the AICPA Trust Services Criteria.
• Own the control inventory and evidence calendar: know which control needs which evidence, from whom, and when.
• Collect, organize, and quality-check audit evidence, and manage auditor requests through to closure.
• Track exceptions and remediation items with control owners until they are fixed and re-tested.
• Build and maintain the evidence tracker and repository by hand (spreadsheets and shared drives); we do not use an automated compliance platform.

Process and communication

• Run recurring control activities: access reviews, security awareness training, policy attestations, and tabletop exercises.
• Turn framework language into plain-English requirements engineers and business staff can act on.
• Report compliance status, open risks, and audit progress to Bertram Labs leadership in a clear, regular cadence.
• Collect the evidence the CISO needs to answer investor (LP) due diligence questionnaires (DDQs) and other security questionnaires.
• Support incident response documentation and post-incident reviews as needed.
• Perform other duties and projects as assigned.

Qualifications

• 0–3 years of experience in information security, GRC, IT audit, risk, or IT operations. Internships and relevant academic projects count.
• Bachelor's degree in cybersecurity, information systems, computer science, or a related field, or equivalent practical experience.
• Working knowledge of at least one major security framework (NIST CSF, NIST SP 800-53, ISO/IEC 27001, or CIS Controls) and how controls map between them.
• Basic understanding of SOC 2: what the Trust Services Criteria are, and the difference between a Type I and a Type II report.
• Exceptional organization: you can track dozens of open items across many owners without dropping any.
• Clear written and verbal communication, including the ability to explain security requirements to non-technical leaders.
• Process mindset: you document how things are done, then make them repeatable.
• Comfort with core IT concepts: identity and access management, endpoints, networks, and cloud services.

Preferred Qualifications

• Relevant certifications, such as ISC2 CC, CompTIA Security+, ISACA CISA, or ISC2 CGRC.
• Hands-on involvement in a SOC 2, ISO/IEC 27001, or similar audit, on either the company or the auditor side.
• Strong Excel or Google Sheets skills for building and maintaining compliance trackers. Exposure to compliance automation platforms (Vanta, Drata, or similar) is a plus.
• Familiarity with public cloud environments (AWS, Azure, or Google Cloud) and Microsoft 365 or Google Workspace security settings.
• Experience with ticketing and project tools (Jira, monday.com, or similar) to run compliance work.

Compensation and Benefits

The expected salary range for this position is: $120,000- $150,000 total annual compensation. Offered salary may be based on a variety of factors including skills, experience, and qualifications for the role. Other compensation includes profit sharing.

Comprehensive medical, dental, and vision benefits are provided at no cost to the employee. We offer a generous 401K match as well as a “take what you need” PTO policy.

If hired, employee will be in an “at-will position” and the Company reserves the right to modify base salary (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.

Diversity, Equity, and Inclusion

At Bertram Capital we value and celebrate the many perspectives that arise from a variety of cultures, genders, religions, national origins, ages, abilities, socioeconomic status and sexual orientation. Our commitment to Diversity, Equity and Inclusion (DEI) ensures that Bertram is a place that attracts, grows, and promotes top talent from all backgrounds.