Security and Compliance Lead

About Virtido

Virtido is an entrepreneurial and innovative IT company headquartered in Zurich, Switzerland. We realize ideas and projects – from strategic concept to technical implementation – closely alongside our dynamic clients, with a strong focus on start-up and fast-growing companies. Since inception in 2015, we have grown rapidly to currently 140+ professionals across Switzerland, Poland, Ukraine, and the Philippines.

About the Client

Our Client is the first virtual assistant specifically designed for psychotherapy. Our AI-powered practice management software automatically generates session notes and psychological reports, giving therapists more time to focus on their patients.

About this Role

We work at the intersection of mental healthcare, AI, and software. Security is central to what we build: we process highly sensitive data and already hold C5 and ISO27001 certification. 

We are looking for a hands-on IT Security & Compliance Lead to own security and compliance end-to-end.

This is a broad role in a small team. You will not only define policies — you will implement systems, configure tools, improve cloud and product security, run audits, and work directly with engineering to make security a practical part of how we build.

Your goal is to make our system more secure while helping the team move faster, not slower.

Responsibilities

You own IT security and compliance end-to-end. In practice, that means:

• Cloud security, hands-on: IAM, network, encryption, logging, monitoring, detection
• Product security together with engineering: web, desktop, mobile, backend, AI systems
• DevSecOps: embedding security into the development lifecycle, threat modeling, vulnerability management
• Compliance end-to-end: ISO27001 and, most importantly, C5 — audits, evidence, risk management, corrective actions, auditor communication, internal training
• Coordinating external security work: penetration tests, security reviews, vendor assessments
• Internal IT security: you own design and baseline — identity, MDM, device policies, access model, on-/offboarding

Requirements

• You have built and hardened cloud security yourself (eg. AWS, GCP) — IAM, network, encryption, logging, detection — and you work in infrastructure-as-code: you change Terraform yourself, you don't file tickets for it
• DevSecOps and application security: secure SDLC, threat modeling, vulnerability management
• You have carried an ISO27001 certification or C5 attestation end-to-end at least once, including audit ownership and auditor communication. C5 matters most to us, but ISO27001 or SOC 2 at that level transfers well. You can design and implement controls, not just document them.
• You work directly with engineers on technical security topics and can push back on architecture
• Pragmatic judgment and strong operational ownership in a small, async-first team
• You reside in Berlin and/or willing to relocate and be onsite
• You have good level of English and German

Nice to Have

• Healthcare, or another environment handling highly sensitive data
• Experience setting up security in an early-stage or fast-growing company

Where this role can grow

• Cloud infrastructure: taking on more platform ownership alongside security
• AI security: building this from scratch — agent permissions, tool access boundaries, data flows to model providers, threat modeling for LLM systems in a clinical context. Very few people have done this yet.
• Medical Device Regulation: as our product evolves, MDR becomes relevant. The natural entry point is the cybersecurity and software lifecycle side (Annex I 17.2, IEC 62304), which overlaps directly with the security work you'd already own.

What matters beyond the checklist

• ISO27001 and C5 are in place and yours to own. That means maintaining them, keeping Vanta current, and updating controls and policies as we grow. What we don't need is someone to collect evidence. We need someone who decides what a control should actually be, builds it, and can tell whether it works.
• We are a 10-person startup. This role needs breadth, ownership, and hands-on execution. You will move between cloud security architecture, product reviews, audit evidence, and access policies, sometimes in the same week. We are not looking for someone who only writes policies, but for someone who builds and operates the security foundation VIA needs as it scales.

Benefits

• Direct access to founders, CTO, and the full multidisciplinary team
• Broad ownership over a core company function
• Equity participation in a fast growing and profitable AI startup
• Results over hours logged
• Work at the intersection of AI, healthcare, software, and security
• Office in Berlin Mitte, flexible hours