At a glance
- Employment
- Full-time
- Workplace
- Remote
- Location
- Remote
About the role
- The GRC and Security Compliance Lead will own the written and evidentiary backbone of Deepgram's security and privacy program. This role involves managing SOC 2, ISO 27001, and PCI DSS obligations, maintaining public posture documents, and ensuring technical claims are accurate across various deployment models.
Responsibilities
- Own audit evidence end to end for SOC 2, ISO 27001, and PCI DSS.
- Own control mapping across frameworks to ensure one piece of evidence satisfies multiple requirements.
- Manage colocation and infrastructure vendor compliance, including SOC reports and physical security language.
- Maintain the security questionnaire answer library and handle security sections of RFPs.
- Author and manage the lifecycle of internal security policies and standards.
- Own public-facing posture documents including Trust Center content, AI Safety statements, and Model Cards.
- Maintain accurate data flow maps and records of processing across hosted and self-hosted deployments.
- Run compliance and security awareness training and enablement for internal teams.
- Partner with Security Engineering to automate evidence generation from infrastructure logs.
- Support the privacy program by contributing to DPIAs, transfer impact assessments, and vendor privacy reviews.
Requirements
- Substantial experience in GRC, security compliance, or technical compliance documentation.
- Proven experience carrying at least one audit cycle end to end from the evidence side.
- Exceptional writing skills capable of producing documentation for auditors, customers, and engineers.
- Hands-on involvement in at least one formal audit (SOC 2, ISO 27001, or PCI DSS).
- Experience mapping controls across more than one framework.
- Technical fluency to read architecture diagrams and understand data flows in colocation and cloud environments.
- Working knowledge of GDPR, CCPA/CPRA, and emerging AI regulations.
- Ability to exercise startup-friendly judgment regarding policy mandates versus carve-outs.
Preferred qualifications
- Certification such as CISA, ISO 27001 Lead Implementer/Auditor, CIPM, CIPT, or CIPP/E.
- Audit experience in an on-premise, colocation, or hybrid environment.
- Experience with compliance automation platforms like Vanta or Drata.
- Familiarity with AI governance frameworks such as NIST AI RMF, ISO/IEC 42001, or the EU AI Act.
- Experience with ML/AI data pipelines and training-data governance.
- Compliance work in a hybrid model involving multi-tenant SaaS and self-hosted deployments.
- Comfort with SQL, light scripting, or AI/agentic tooling for evidence assembly.
- Exposure to HIPAA or FedRAMP.
Workplace
- Remote role based in the USA.
Skills
- SOC 2
- ISO 27001
- PCI DSS
- GDPR
- CCPA
- CPRA
- Ansible
- GitHub Actions
- Docker
- SQL
- Vanta
- Drata
Show all 14 skills
- NIST AI RMF
- ISO/IEC 42001
