Chief Information Security Officer (CISO)

About MasterControl MasterControl Inc. is a leading cloud-based quality and compliance software provider for life sciences and other regulated industries. Our mission is to enable our customers to bring life-changing products to market faster while ensuring compliance and quality throughout the product lifecycle. We are committed to innovation, customer success, and making a positive impact on the world. SUMMARY We are looking for a Chief Information Security Officer, reporting to the CTO, to own our enterprise security strategy and risk program, including the security and governance of AI use across our engineering organization. You'll be the executive owner of risk assessment, security governance, and incident response, and a close partner to Sales, Customer Success, and Compliance when customer security reviews or due diligence conversations need executive-level backing. This is not a primarily customer-facing role, but you should be comfortable stepping into a customer conversation when a deal or renewal calls for it. WHY THIS ROLE MATTERS Our customers trust us with sensitive data in a highly regulated industry, and much of our customer base is in life sciences — where a security or privacy failure doesn't just cost a deal, it can jeopardize a customer's own regulatory standing (GxP, FDA-regulated processes, clinical and quality data). Security and data governance are not back-office functions here; they are part of the product's value proposition and a precondition for enterprise and government customers to say yes. We also operate infrastructure across multiple regions, which means data privacy and residency obligations - including GDPR and other cross-regional requirements — are a standing part of the job, not a one-time compliance exercise. This role will shape how confidently we can expand into new regions and regulated verticals, and how well we protect the trust we've already built with existing customers. RESPONSIBILITIES Cybersecurity Strategy & Governance Define and execute the company's enterprise security strategy, aligned with business objectives and compliance obligations (including FedRAMP). Own security governance, policies, standards, and risk management practices across the organization. Embed security-by-design principles across systems, applications, cloud infrastructure, and engineering workflows. Set policy for access control, data protection, and secure development practices, partnering with Engineering to embed requirements into the SDLC without becoming a bottleneck. Own data privacy and residency requirements across the regions where we operate infrastructure, including GDPR and other applicable cross-regional obligations. AI Security & Governance Own the security and governance model for how AI and LLM tooling are used across engineering — controlling what data can reach which models and keeping regulated data inside trusted boundaries. Implement guardrails for AI and agentic workflows to catch data leakage, prompt injection, and unsafe outputs before they reach production or customers. Partner with Engineering leadership to make security a built-in part of our AI-driven SDLC tooling, not a gate bolted on afterward. Evaluate and, where appropriate, pursue recognized AI governance frameworks (e.g., ISO 42001) to give customers confidence in how we govern AI use. Help turn our AI security posture into a competitive advantage in customer conversations, in partnership with Sales and Compliance. Risk Assessment & Management Own the enterprise risk assessment program: identify, quantify, and track risk across infrastructure, applications, vendors, and third parties. Run and continuously improve a formal risk register with clear ownership, remediation timelines, and executive reporting. Lead risk assessments for cloud infrastructure and key third-party dependencies (e.g., AWS, Azure), and for new products, features, or architecture changes before launch. Translate technical risk into business terms fo…