At a glance
- Experience
- 7+ years experience
- Employment
- Full-time
- Location
- San Francisco
About the role
- Compliance is increasingly a customer-facing, contractual function rather than an internal exercise, and we are looking for someone to own it.
- This role owns that function end to end: our audits, our evidence base, our risk register, and the security diligence that customers put us through before and during a contract.
- You will work directly with the Head of Security and across engineering, IT, legal, and sales as a program-ownership role.
Responsibilities
- Own our SOC 2 Type II and ISO 27001 programs, and future frameworks as we take them on, including scope, evidence, control operation, and the relationship with our external auditors.
- Own and complete the control evidence base in our compliance automation platform, moving controls from partially substantiated to audit-ready and keeping them there.
- Lead security diligence for enterprise and regulated customers: security questionnaires, audit responses, right-to-audit requests, and the recurring reporting these customers require.
- Own the risk register and mature risk management from a security-team activity into a recorded, enterprise-aligned program.
- Coordinate the compliance obligations that come with customer contracts, including data protection, breach-notification timelines, and vendor and subprocessor assessments, in partnership with legal.
- Assess and stand up new certifications as the customer pipeline requires them.
- Partner with engineering and IT to make evidence collection a byproduct of how systems already run, rather than a manual scramble before each audit.
Requirements
- 7+ years in governance, risk, and compliance, ideally including time at a high-growth startup.
- Demonstrated ownership of SOC 2 and ISO 27001 programs, including running audits end to end with external auditors.
- Experience fronting security diligence for enterprise or regulated customers.
- Working fluency with compliance automation platforms (such as Vanta or equivalent) and with turning tooling into genuinely audit-ready evidence.
- A strong grasp of security controls and how they operate in a cloud and SaaS environment.
- The judgment and communication to run a program independently, coordinate across functions, and be trusted as the single owner of compliance.
Preferred qualifications
- Experience with regulated-customer contractual security obligations: data protection agreements, breach notification, and right-to-audit provisions.
- Exposure to newer or higher-bar frameworks (for example FedRAMP) and a sense of what standing them up would take.
- Experience building a compliance function or team, since this role can grow into one as the company scales.
- Familiarity with cloud infrastructure or AI or ML platforms.
Benefits
- Competitive salary and equity
- Health/dental/vision coverage (many plans up to 99% employer-covered)
- Flexible time off
- Paid parental leave
- Mental health support
Skills
- SOC 2 Type II
- ISO 27001
- Vanta
- FedRAMP
