Director of Information Security

Company Description

Yello is a Chicago-based talent acquisition software provider founded in 2008 that specializes in campus, early talent, and high-volume recruitment. The platform enables over 300 enterprises to source, engage, and hire candidates through tools like event management, interview scheduling, and candidate evaluations.

About The Role

Yello is seeking a Director of Information Security to lead and maintain the company's information security program. This role is responsible for security operations, vulnerability management, incident response, and maintaining the technical security requirements of our commercial and FedRAMP environments.

The Director will work closely with Engineering and Risk & Compliance to protect Yello's systems and customer data while supporting the company's continued growth and adoption of emerging technologies, including AI.

This is a hands-on role requiring strong technical knowledge, practical judgment, and the ability to work independently.

How You'll Make An Impact

• Security Operations: Manage security monitoring, vulnerability scanning, security assessments, and remediation tracking across Yello's systems and applications.
• FedRAMP Compliance: Own ongoing continuous monitoring (ConMon), Plans of Action & Milestones (POA&Ms), and maintenance of the System Security Plan (SSP), working with engineering to ensure technical controls remain effective.
• Incident Response: Maintain incident response procedures and coordinate the investigation, escalation, and resolution of security incidents.
• Security Best Practices: Partner with engineering to embed security throughout the software development lifecycle (shift-left), including secure architecture, automated scanning, dependency management, and CI/CD security controls.
• AI Security: Evaluate security risks associated with AI tools, integrations, and product features, establishing practical safeguards for data protection and access.
• Security Governance: Maintain security policies and standards, communicate material risks to leadership, and support Risk & Compliance with audits, customer security requests, and regulatory requirements.
• Work with clients and vendors to remediate findings
• Maintain information security awareness within the organization by providing training materials and guidance for both technical and non-technical employees
  

What We're Looking For

• 5+ years of experience in information security, including security operations and risk management.
• Experience with FedRAMP, NIST 800-53, continuous monitoring, and security documentation.
• Strong technical understanding of cloud security, preferably AWS, and web application security.
• Experience with vulnerability management, security monitoring tools, and incident response.
• Ability to work collaboratively with engineering teams to identify and resolve security risks.
• Strong communication skills and the ability to independently manage competing priorities.
  

Additional Information

• Experience with DoD security requirements, including FedRAMP+ and IL4.
• Experience with Kubernetes, container security, infrastructure automation, and CI/CD security.
• Familiarity with SIEM platforms, vulnerability management tools, and security automation.
• Experience securing AI/LLM applications, autonomous agents, and AI-assisted software development.
• Experience with SOC 2 and ISO 27001 security controls.
• CISSP, CISM, CCSP, or equivalent practical experience.
• We are open to remote candidates based in the following states: AZ, CA, CO, FL, GA, IL, IN, KS MI, NC, NV, NY, TX, WI, and WA
• Yello is an Equal Opportunity Employer. All applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status
• You must be authorized to work in the United States. Yello is not offering visa sponsorship for this role
• The expected salary range for this role is $165,000 and $195,000 annually.