At a glance
- Experience
- 5+ years experience
- Workplace
- Remote
- Location
- Remote
About the role
- The Compliance Manager will own and drive Sourcegraph’s governance, risk, and compliance (GRC) program with a primary focus on compliance.
- This is a hands-on, cross-functional role responsible for maintaining certifications like SOC 2 and ISO 27001 while preparing the organization for future frameworks.
- The role requires an individual contributor who can personally manage audits, design controls, and translate compliance requirements for technical and non-technical teams.
Responsibilities
- Own and evolve the company's governance, risk, and compliance program.
- Manage SOC 2 and ISO 27001 certification programs end-to-end.
- Design and tailor controls to fit the business environment.
- Collect evidence and manage documentation for audits.
- Coordinate directly with external auditors and manage remediation efforts.
- Maintain the risk register, ISMS processes, and compliance policies.
- Provide practical guidance to internal teams regarding compliance responsibilities.
- Support customer-facing compliance activities, including security questionnaires.
- Identify control gaps and recommend practical solutions.
- Implement automation or AI to improve compliance workflows.
Requirements
- 5+ years of experience in governance, risk, compliance, information security compliance, or a related role.
- Demonstrated end-to-end ownership of SOC 2 and ISO 27001 programs in a SaaS or technology startup environment.
- Experience personally managing external audits and certification processes.
- Strong understanding of risk management, control design, and ISMS governance.
- Familiarity with cloud-based technology environments and security considerations for remote workforces.
- Strong project management and organizational skills.
- Excellent written and verbal communication skills.
- Hands-on mindset with a willingness to personally execute compliance tasks.
- Ability to work with hours overlapping with GMT-3 for at least 20 hours per week.
Preferred qualifications
- Experience with GDPR, HIPAA, HITRUST, FedRAMP, FISMA, PCI DSS, or related standards.
- Experience supporting security questionnaires or sales-related compliance activities.
- Experience with GRC platforms or compliance automation tools.
- Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer/Auditor, or CRISC.
Benefits
- Competitive cash compensation
- Meaningful equity
Workplace
- Remote role.
- Working hours must overlap with GMT-3 for at least 20 hours per week.
Skills
- SOC 2
- ISO 27001
- GRC
- Risk Management
- ISMS
- Compliance Automation
