Security & Compliance Lead

Company Overview

Litehouse is a district operating system that brings clarity, coordination, and intelligence to how smart venues and mixed-use districts operate. It's an AI-enabled technology platform that creates a single coordinating layer above a district's existing systems to make them collectively intelligent.
Litehouse was originally incubated within the H&S Ventures portfolio. It was built by operators who have been through the full complexity of what it takes to bring a full-scale multi-use district to life — the technical architecture, the organizational design, the governance debates, the moments where the ambition of the project collides with the reality of execution. That lived experience didn't just inform Litehouse, it led to its creation.
The company is evolving from incubation into a scalable, market-ready platform, with a strong emphasis on platform architecture, operational rigor, and customer-driven innovation.

Core Responsibilities

Compliance & Governance

• Own and administer Litehouse's Vanta instance, including continuous control monitoring, evidence collection, and remediation triage.
• Manage the ongoing SOC 2 Type II audit cycle: auditor liaison, evidence packages, and control remediation.
• Refine and maintain Litehouse's GDPR and UK GDPR program, including the Record of Processing Activities, data processing agreements, DPIAs, and sub-processor management.
• Refine and maintain security and compliance policies, keeping them aligned with each other and with how Litehouse is actually built.
• Own the response to enterprise client security reviews and questionnaires, and manage vendor and third-party risk assessments.

Security Operations & Technical Assurance

• Verify that security controls are actually in place across Litehouse's infrastructure, reading the Terraform and cloud configuration closely enough to confirm that what's documented is real, and partnering with engineering to close any gaps.
• Set and maintain the security requirements for secrets, identity, access controls, and CI/CD security gates, and confirm that engineering's implementation meets them.
• Own vulnerability management and coordinate external penetration testing, including triage and remediation tracking.
• Define infrastructure hardening and monitoring requirements for security-relevant events, including client-specific needs like regional deployment and data residency, and verify they're met.

Incident Response & Risk Management

• Coordinate incident response processes, including tabletop exercises, runbooks, and after-action reporting.
• Maintain the risk register and drive remediation against it.
• Support breach and incident notification against GDPR and SOC 2 timelines.

Cross-Functional Partnership

• Partner with engineering on infrastructure changes through a documented change-management process (peer review and tracked approvals), so security requirements are met without the work depending on any one person's unilateral judgment.
• Work alongside Litehouse's external audit firm, external DPO service, and fractional security advisors: you own the operational program, they provide independent oversight and specialist depth.
• Support sales and customer success in client conversations that involve security or compliance.

Qualifications

Required Experience and Capabilities

• 4+ years in security and compliance (GRC), including direct, hands-on ownership of a compliance program.
• Relevant certification: CISSP, CIPP with CIPPE/E for EU GDPR, CISA, CCSP, Security+, or an Azure/AWS security specialty certification.
• Enough technical grounding to verify controls yourself: able to read infrastructure-as-code (Terraform) and cloud configuration (Azure preferred; AWS or GCP acceptable) and judge whether a control actually holds. You don't need to be the one deploying it, but you need to know whether it's right.
• Direct experience running or materially supporting a SOC 2 program, including administering a GRC platform such as Vanta, Drata, or Secureframe.
• Working knowledge of GDPR and UK GDPR program mechanics: RoPA, DPAs, DPIAs, and sub-processor management.
• Experience authoring security policy and responding to enterprise client security questionnaires.
• Strong written communication. You'll be the translator between auditors, engineers, and clients.

Nice to Have

• Hands-on infrastructure or DevOps experience (writing and deploying IaC, managing CI/CD, cloud administration). Valued, though not required; this role owns and verifies controls, while engineering builds them.
• Experience as a first security or compliance hire at an early-stage company.
• Direct incident response experience.

Ways of Working

• Comfortable owning a compliance program end to end and getting technical enough to verify the work: reading a config, reasoning about an architecture, and judging whether a control actually holds.
• Documentation-first and evidence-driven. "Show me it's real" is your default, for your own work and everyone else's.
• Able to prioritize across competing audit deadlines, client requests, and remediation work without losing track of any of them.
• Comfortable with real autonomy on a lean, distributed team, and willing to say when something is out of scope rather than quietly absorbing it.

Culture and Fit

Litehouse is a lean team that prizes ownership and clear thinking over process for its own sake. The person who thrives here wants to build a security and compliance program and treats an audit finding as something to go fix, not just log.

This is the foundational hire for our security and compliance function, and it's built to grow. As Litehouse and its client base expand, this role has a clear path to Head of Security or CISO, with a team to build behind it. We're looking for someone genuinely energized by starting at the foundation and growing into that seat as the function matures.

Benefits and Working Environment

• Flexible paid time off, with an emphasis on a sustainable pace given the demands of an active audit cycle.
• Support for professional development, including certification costs and relevant training.
• Remote-first, distributed team with an emphasis on clear communication and documentation over meetings.
• Meaningful ownership of a function you're building largely from scratch.
• Direct collaboration with the COO and VP of Engineering, without layers between you and the decisions that affect your work.