Compliance Engineering Lead

Responsibilities

• Own SOC 2 Type II end to end, including the observation window, auditor relationship, audit scoping, controls, findings, and evidence pipeline.
• Lead Socket through ISO 27001 certification by defining the scope and ISMS, conducting gap assessments and internal audits, preparing the organization, and maintaining the ISMS through surveillance audits.
• Build and maintain automated evidence collection from systems of record, including GCP, GitHub, identity providers, MDM, and ticketing systems.
• Create scheduled control monitoring that detects drift and alerts promptly.
• Own compliance platform strategy and evaluate whether to buy, build, or expand existing tooling.
• Run risk management and vendor-risk programs, including the risk register, vendor tiering, reviews, and renewal cadence.
• Own customer-facing assurance materials, including the trust portal and enterprise security artifact library.
• Evaluate AI assurance frameworks and regulations, including ISO/IEC 42001, AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework.
• Report to the CISO and hire and lead the first customer trust teammate focused on security questionnaires, RFPs, and contract security reviews with Legal.

Requirements

• Personally owned at least two complete SOC 2 Type II cycles as the accountable owner, including auditor management, scoping, evidence, and findings.
• Experience taking an organization through ISO 27001 certification or managing an ISMS through surveillance audits.
• Ability to build and maintain automation against services and APIs; experience with GCP, GitHub, identity providers, MDM, and ticketing systems.
• Hands-on experience with Drata, Vanta, or a similar compliance platform, with clear opinions on their strengths and limitations.
• Strong judgment in prioritizing real control and risk gaps versus administrative or formatting issues.
• Excellent written communication for auditors, enterprise security reviewers, engineers, and executives.
• Experience working in a remote, fast-moving environment with shifting priorities and limited predefined structure.

Nice to Have

• Exposure to AI governance frameworks, including ISO/IEC 42001, the NIST AI Risk Management Framework, and the EU AI Act.
• Experience at a security vendor or another company subject to rigorous customer security scrutiny.
• Experience with contract security review alongside Legal.
• Experience building compliance automation in-house.

Benefits

• Market-competitive salary bands.
• Meaningful equity program.
• Comprehensive health benefits with 99% coverage for employees and families.
• Flexible time off, holidays, and winter shutdown.
• Paid parental leave.
• Remote-first work with quarterly team off-sites.