Information Security Lead
About the role
,Responsibilities
,Requirements
,Qualifications
,Skills
,Benefits
,Pay
,Schedule
. Possibly combine Requirements and Qualifications? But we can separate if content fits. The posting includes "Essential Skills" list and "What Sets The Best Candidates Apart". Also "Key Competencies". We need to map content. We must not invent or summarize away detail. Must preserve all substantive info. So we need to include details like responsibilities bullet list, etc. We need to use- for any list of duties/requirements/benefits. Use
for prose. We must not repeat job title as heading. The job title is not given explicitly but we can ignore. We must not include Job ID/requisition numbers. We must remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we need to cut out sections like "How to succeed in this role", "Key Competencies", "Essential Skills", "What Sets The Best Candidates Apart", "Reporting & Team Structure", "Interview Process", "What does joining LineVision mean for you?", "Who we are…", "Message to applicants applying to work in the U.S.", etc. But we must preserve substantive information. However many of those sections contain substantive info like competencies, essential skills, etc. The instruction says remove boilerplate, duplicated lines, and application instructions. It does not say to remove all those sections; we need to keep substantive info but we can reformat into appropriate sections. For example, "Key Competencies" could go under Skills or Requirements. "Essential Skills" is definitely skills. "What Sets The Best Candidates Apart" could be additional qualifications or preferred skills. "Reporting & Team Structure" could be part of About the role or Responsibilities. "Interview Process" is application instructions, should be removed. "What does joining LineVision mean for you?" is more marketing fluff; could be considered boilerplate? Might be considered substantive? It describes impact, ownership, flexibility, real world innovation. Might be considered part of About the role. But we need to decide. We must preserve ALL substantive information; do NOT invent or summarize away detail. So we need to keep the content but we can rephrase? The instruction says "do NOT invent or summarize away detail". That suggests we should not summarize; we should keep the detail as is, maybe just copy sentences. However we can reformat into HTML but keep the text. So we can copy paragraphs verbatim into
or list items. Thus we need to extract the substantive content from the posting and place into appropriate sections. Let's parse the posting: First paragraph: "Hybrid (2-4 days/week in office): Boston, MA Headquarters Step into a pivotal Security Leadership role at a fast-growing grid intelligence company. LineVision’s customers include eight of the ten largest US utilities, which demand the highest levels of security in order to protect sensitive data and the electric grid from attack. You will lead LineVision to achieve a security posture that exceeds industry standards and gives customers the confidence they need to rely on LineVision. Reporting to the VP of Security, IT, and Quality, you will have broad autonomy over security engineering, security operations, controls execution, governance, and compliance. You and a Security Analyst will own our SOC 2 Type II and ISO 27001 programs, risk management, incident response, penetration testing program, and customer security engagements. Partnering with IT, Platform, Hardware, and Customer Success, you will make security a strategic business advantage at LineVision. If you want to build a security program that is seen as a strategic differentiator and wins customer trust, join us at LineVision, Built In Boston Best Places to Work! Please note: Applicants must be currently authorized to work in the United States on a full-time basis. This position is not eligible for employment visa sponsorship." That's About the role. Then "What will you do? Core Responsibilities And Key Performance Objectives" followed by bullet list: - Compliance Program Ownership: Own the annual audit cycle for SOC 2 Type II and ISO 27001 using the Vanta compliance platform, including all controls, internal audits, external audits, and nonconformity tracking to closure. - Risk Management & Governance: Lead the annual NIST CSF risk assessment, monthly Platform and Hardware risk reviews, and quarterly Governance, Risk & Compliance reviews. Maintain policies and report ISMS efficacy metrics to leadership. - Security Engineering: Conduct AWS cloud and Sensor penetration tests, ISA/IEC 62443 product security assessments, vendor and product risk assessments. - Security Operations: Oversee vulnerability management, CrowdStrike Falcon Complete detection rules, NextGen SIEM data feeds, and the MSSP relationship. Monitor open-source license compliance with FOSSA. - Incident Response & Resilience: Own the incident response program and plan, including the annual 3rd part tabletop, business continuity and disaster recovery exercises, and implementation of lessons learned. - Confidential Data Protection: Define and guide data management controls, ensuring rigorous application of policies and customer contractual obligations regarding confidential data. Partner with Platform, Hardware and IT to apply controls across all company systems and applications. - Customer & Sales Support: Lead responses to customer security questionnaires, contract security reviews, and customer-facing security presentations and material. - AI Security: Identify risks and define security standards for enterprise and product AI. Inform the AI governance program with risk assessments and recommendations. - Team Leadership: Coach and develop the security team. - This role requires participation in a compensated rotational on-call schedule. On-call responsibilities are a condition of employment for this position. Then timeline sections: Within the first 3 months: ... etc. Those are also responsibilities/objectives. Could be included under Responsibilities as more detail. Then "How to succeed in this role Key Competencies" list: - Ownership: take full responsibility for the security program's outcomes, from audit results to customer confidence. - Planning & Prioritization: absorb interrupt-driven work (questionnaires, incidents, audit requests) while keeping long-term projects on schedule, and raise a flag early when something must slip. - Communication: explain risk clearly to engineers, executives, customers, and auditors; tailor the message to the audience. - Judgment: make risk-based decisions that balance security with business velocity. - People Leadership: develop direct and cross-functional team members and delegate meaningful ownership rather than doing the work yourself. Then "Essential Skills" list: - 6+ years in information security, with at least 2 years in a lead or people-management role. - Direct ownership (not only support) of SOC 2 Type II and ISO 27001 audits. - Experience conducting risk assessments with NIST CSF or an equivalent framework. - Hands-on experience with penetration test management, vulnerability management, and EDR/SIEM tooling (CrowdStrike preferred). - Experience with AWS cloud security. - Experience responding to enterprise customer security questionnaires and contract requirements. - CISSP, or a commitment to earn it within 18 months of start date. Then "What Sets The Best Candidates Apart" list: - Experience with OT/ICS or IoT security, including IEC 62443. - Familiarity with utility sector requirements (CEII, NERC CIP) or other regulated critical infrastructure. - Experience leading incident response for a real event. - Experience with Vanta or similar compliance automation. - Experience in AI Governance and/or assessing the security of AI tools and features. Then "Reporting & Team Structure" paragraph. Then "Interview Process" list (application instructions) - should be removed. Then "What does joining LineVision mean for you?" paragraphs: - Impact. Your talent, time, and energy will critically impact our success in accelerating our mission of providing utilities with grid intelligence to enable affordable, reliable power. - Ownership. You will hold broad responsibilities with high autonomy and trust in a communicative, collaborative, and fast-paced environment. - Flexibility. You will be empowered to maintain work-life balance with trust-based PTO and a flexible work schedule. - Real World Innovation. You will join a motivated and high-performing team working with cutting edge, patented technology to help solve key obstacles to meet the demands of an AI-powered future. Then "Who we are…" paragraph about LineVision. Then "Message to applicants applying to work in the U.S." includes salary range and benefits description. Then "Salary Description $125,000-140,000 + variable comp + equity" We need to include Pay and Benefits sections. Pay: base salary range $125,000-140,000 USD, plus variable comp and equity, bonus plan. Benefits: comprehensive benefits package including medical, dental, vision and disability insurance, commuter benefits, a 401(k) with company match, and trust-based paid time off. Benefits subject to eligibility. Schedule: Hybrid (2-4 days/week in office): Boston, MA Headquarters. Also on-call rotational schedule compensated. Flexible work schedule, trust-based PTO. We need to avoid filler like "commensurate with experience". Not present. We must not create sections with filler. So we will include sections only if we have content. Now we need to output HTML fragment only, no markdown fences. We'll structure:
About the role
... (the paragraph about role)
Responsibilities
- ... each responsibility bullet ...
- .
We must preserve all detail; we can keep the exact sentences.
We need to be careful not to duplicate content. The responsibilities list includes many items; we can include them as is.
We also have "Key Competencies" which could go under Skills or maybe a separate section? The instruction says use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we should map content to those headings. Key Competencies could be under Skills. Essential Skills also under Skills. What Sets The Best Candidates Apart could be under Qualifications (preferred qualifications). Or we could treat Requirements as mandatory essential skills, Qualifications as preferred. But we have both Requirements and Qualifications headings available. We'll assign: - Requirements: Essential Skills (mandatory) - Qualifications: What Sets The Best Candidates Apart (preferred) plus maybe CISSP commitment? But CISSP is in Essential Skills. We'll keep. - Skills: Key Competencies (soft skills) maybe also include technical skills? But we already put technical in Requirements. Could also include both. However we need to avoid duplication. Let's decide: Requirements: the Essential Skills list (6+ years, direct ownership, NIST CSF, penetration test management, AWS, customer questionnaires, CISSP commitment). Qualifications: What Sets The Best Candidates Apart list (OT/ICS, utility sector,