The whole team. One platform.

Run the programme

• CISOFour teams, four numbers, one board meeting. Here the board pack, the maturity grade, the budget line and the permission matrix all read off the data your team already works in.STRATEGY
• Security ManagerOwn the operational day: the vulnerability queue, incidents from triage to lessons learned, access certifications, hardening sign-offs and phishing rounds. Each carries an owner, a date and a record behind it.OPS
• Risk ManagerSpreadsheet registers miss the connections. Set the scoring methodology once, then let every entry hold the controls, processes, incidents, KRIs and vulnerabilities it actually touches, with treatment plans and formal acceptances on the record.RISK

Prove it

• Compliance OfficerMap one control to several frameworks, take the audit cycle from scope to certificate upload, then close each finding against a verify step instead of an opinion.COMPLIANCE
• Data Protection OfficerA regulator's question should be answerable from the register itself. Article 30 entries, DPIAs, consent records and processors sit in one dataset, with data subject requests broken into tasks. Seeded in the platform as Privacy Officer — the same job under the US title.GDPR
• External AuditorTwo doors lead here. A scoped read-only role for a named account reads compliance, the control library, the documents and the risk register; an invitation code opens the six-tab auditor portal with no platform account at all.AUDIT

Run the day

• SOC ManagerContinuity is the SOC's hardest problem; it dies at seven in the morning. Rota, escalation, workload and a signed handover keep it alive. Cases and incident records are yours to close — or to delete.SOC
• Security AnalystTriage from the case queue, then live inside the incident record: IOCs, evidence and timeline as you go. Check whether this happened before, then hand the fix on as a task with a date on it.TRIAGE
• IT ManagerAn inventory is accurate on the day it was exported. Here the register stays live, exceptions are written decisions and each system is scanned against its baseline with the hardening add-on.ASSETS

Own a programme

• Business Continuity ManagerProcess owners who never log in still have to answer the impact questionnaire. Scope the BIA as a campaign, author the plans behind it, then test them on a schedule with findings attached to every run.BCDRP
• Third-Party Risk ManagerVendors answer without an account, templates spawn every round and recurrence raises the next assessment on its own. What is left for you is the overdue list, worked from a pipeline rather than a memory.TPRM
• Security Awareness ManagerTraining that only reaches people with a login is not a programme. Modules are yours to author, enrolment goes by department and phishing runs on a recurring schedule, read per recipient rather than as one company rate.AWARENESS

Roles are yours to change

78 seeded roles, 203 permissions, and your own on top. Least privilege by default — not a setting you remember to switch on.

Not on this list?

Tell us the job title on the demo form. For the industry view, see use cases.