Chief Information Security Officer
Posted 13 Oct 2026
BranchFactor Summary
The original posting with the fluff stripped out
- Management level
- Individual contributor
- Employment
- On-Site
- Contract
- Full-time
No salary listed for this role.
About Campfire
Campfire is a next-gen core accounting platform built for modern mid-market finance teams. We’re building the future of ERP by replacing outdated systems and manual accounting processes with an AI-native platform that helps finance teams move faster and operate more efficiently.
The role
Campfire is hiring its first full-time CISO to own security, compliance and customer trust as we sell to larger enterprises.
-
Campfire is an AI-native ERP and financial automation platform. We raised a $65M Series B led by Accel and Ribbit Capital.
-
Customers trust us with their general ledger, bank details, payroll and vendor data.
-
Today, security is run by a fractional vCISO firm plus a few engineers. Deals are increasingly gated on security reviews.
-
You will turn that into an in-house program that closes deals faster and keeps us safe.
What you'll own
Customer security reviews and deal support
-
Answer security questionnaires, TPRMs and RFPs (SIG, CAIQ, custom) with a fast, predictable turnaround.
-
Join customer and prospect calls with CIOs and IT security teams, including implementation kickoffs.
-
Maintain a trust center and security collateral pack: policies, pentest reports, network architecture, insurance certificate.
Compliance and audits
-
Own SOC 1 and SOC 2 (Type I and II): scope, auditor management, bridge letters, and customer follow-up questions.
-
Decide and lead the path to ISO 27001, ISO 42001 and other frameworks customers ask about.
-
Run Vanta as the system of record for controls and evidence.
Privacy and contracts
-
Partner with Legal on DPAs, BAAs, GDPR transfer mechanisms (SCCs / DPF), DORA and non-US privacy laws.
-
Review security and audit-cooperation clauses in customer contracts.
-
Own data retention, export and residency answers, including new-region or GovCloud requests.
Security operations and incident response
-
Own the incident response plan, run tabletop tests, and lead response when incidents happen.
-
Own customer breach notification decisions and post-incident write-ups.
-
Own detection and email security: SIEM, EDR, email protection, identity alerting.