About Irth
Irth develops SaaS solutions for utility damage prevention and infrastructure risk management. Gas, electric, telecommunications, and pipeline operators across the United States and Canada rely on our products—including UtiliSphere, DigTix, Insights, Borealis, and Stake Center—to protect critical infrastructure.
Because our customers operate critical infrastructure, they expect strong security practices and adherence to rigorous security standards.
We are seeking a hands-on Cybersecurity Lead to strengthen and oversee Irth's security program. This individual will serve as both a cybersecurity practitioner and policy leader, partnering closely with engineering, infrastructure, IT, GRC, and executive leadership.
The ideal candidate can translate security findings into actionable remediation, lead incident response, establish security standards, and clearly communicate Irth's security posture to customers and stakeholders.
Key Responsibilities
1. Vulnerability Management & Remediation
Own the triage and prioritization of security findings from SAST tools, infrastructure security assessments, penetration tests, and newly disclosed CVEs.
Assess risk and severity, establish remediation priorities, and assign ownership and deadlines.
Partner directly with engineering and infrastructure teams to resolve vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning.
Integrate security findings into engineering work management systems, ensuring every finding has an assigned owner, tracking ticket, and target remediation date.
Report remediation progress, outstanding risks, and security trends to IT, engineering, and executive leadership.
Provide appropriate vulnerability and remediation updates to customers.
2. Incident Response & Security Communications
Lead security incident response from initial detection and investigation through containment, remediation, and post-incident review.
Coordinate urgent vulnerability and CVE responses across technical teams.
Establish and manage incident communications, including internal status updates, executive briefings, and Customer Experience talking points.
Prepare accurate, timely customer-facing communications regarding potential exposure, remediation status, and detection activities.
Maintain incident response runbooks and on-call escalation procedures.
Conduct regular incident response tabletop exercises.
3. Cloud, Identity & Access Security
Own cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.
Establish and enforce identity and access management policies covering:
Least-privilege access
Role-based access and permissions
Session duration and expiration
Multi-factor authentication (MFA)
Privileged access management
Employee and contractor onboarding, transfers, and offboarding
Manage and strengthen identity controls across Microsoft Entra ID and AWS IAM.
Conduct regular access reviews for employees, contractors, and third-party vendors.
Identify and remediate excessive permissions, inactive accounts, and access control gaps.
4. Security Policy, Compliance & Customer Trust
Develop, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST Cybersecurity Framework (CSF) and ISO 27001.
Own the technical security controls supporting SOC 2 Type II and ISO 27001 compliance.
Partner with Governance, Risk, and Compliance (GRC) teams on audit readiness, evidence collection, and remediation of control gaps.
Monitor regulatory and industry requirements affecting critical infrastructure customers, including:
TSA pipeline security directives
NERC CIP-related customer security expectations
Applicable Canadian privacy legislation
Translate applicable regulatory and customer requirements into practical technical security controls.
Lead technical responses to customer security questionnaires in partnership with GRC.
Represent Irth's…