Compliance Manager
New York, NY · San Francisco · 4-7 years experience · Full-time · Onsite · Posted Oct 9, 2026
At a glance
- Experience
- 4-7 years experience
- Employment
- Full-time
- Workplace
- Onsite
- Location
- New York, NY · San Francisco
- Visa sponsorship
- Visa sponsorship available
About the role
- Reflection AI is seeking a senior generalist Compliance Manager to flex across multiple pillars including AI Governance, Data Governance, Trade Compliance, Privacy Operationalization, Government Contracting Compliance, and Corporate Compliance.
- The role involves taking ambiguous, cross-cutting problems and turning them into working programs such as policies, SOPs, training, and monitoring.
- This position acts as a force multiplier for pillar leads and a direct partner to the Head of Compliance and AI Governance.
Responsibilities
- Stand up and maintain compliance processes and SOPs across pillars (e.g., insider risk, background checks, external reporting process, vendor/compliance tooling)
- Support our security framework compliance posture (SOC 2, ISO 27001, NIST 800-53/800-171, CMMC) by maintaining evidence, coordinating with control owners, and prepping for audits and assessments
- Own or support day-to-day TPRM operations: vendor security questionnaires, risk tiering, onboarding reviews, and tracking remediation of vendor findings
- Respond to inbound customer and partner security/compliance questionnaires, pulling in subject-matter owners as needed
- Partner with pillar leads (AI Governance, Data Governance, Trade Compliance, Privacy, Gov Contracting) to fill gaps, cover surge work, and keep cross-pillar initiatives moving
- Draft and maintain policies, process documentation, and training materials for internal and external audiences
- Track regulatory developments (AI, data, privacy) and translate them into concrete internal workstreams
- Prepare materials for leadership and cross-functional updates (steering committees, exec reporting, knowledge-share sessions)
- Identify process gaps and build the scaffolding (trackers, templates, intake forms) to close them
Requirements
- 4-7 years in compliance, risk, legal operations, or a related GRC function, ideally in tech or a regulated industry
- Direct experience with at least one security framework (SOC 2, ISO 27001, NIST) and with TPRM/vendor risk processes (questionnaires, risk tiering, onboarding review)
- Demonstrated ability to own a problem end to end with minimal supervision, across unfamiliar subject matter
- Strong written communication; comfortable turning ambiguous asks into clear policies and SOPs
- Experience working cross-functionally with Legal, Security, Privacy, People, and Engineering stakeholders
- Comfortable context-switching across multiple active workstreams
Preferred qualifications
- Exposure to AI governance, data privacy (GDPR/CCPA), export controls (ITAR/EAR), or federal contracting compliance (CMMC, FAR/DFARS)
- Experience with GRC or compliance tooling (e.g., Vanta or similar platforms)
- Experience responding to customer-facing security questionnaires or supporting enterprise sales/procurement cycles
- Prior experience in a high-growth or startup environment where the compliance function is still being built
Benefits
- Top-tier compensation: Salary and equity structured to recognize and retain our talent globally
- Stock options
- Comprehensive medical, dental, vision, and life
- Annual wellness allowance
- Lunch and dinner provided in the office daily
- 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys
- Unlimited paid time off in the U.S. and 30 days in the U.K.
- Sponsorship support
- Regular off-sites, happy hours, and team celebrations
Skills
- SOC 2
- ISO 27001
- NIST 800-53/800-171
- CMMC
- GDPR
- CCPA
- ITAR
- EAR
- FAR
- DFARS
- Vanta
