Compliance Engineering Lead
Socket · Remote · United States ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Fully remote
- Reports to CISO
- SOC 2 & ISO 27001
- Automation focus
- Equity included
Join Socket as a Compliance Engineering Lead to transform compliance into an engineered system. You will own the end-to-end compliance program, automating evidence collection from systems like GCP and GitHub to support enterprise security requirements.
Reporting directly to the CISO, you will manage SOC 2 Type II and ISO 27001 certifications while building a trust portal for customers. This foundational role involves hiring your first teammate and shaping the future of Governance, Risk, and Compliance at the company.
What you'll do
- Own SOC 2 Type II audits, including scope, auditor relations, and evidence pipelines.
- Lead ISO 27001 certification, defining the ISMS and running gap assessments.
- Automate evidence collection from GCP, GitHub, identity providers, and MDM tools.
- Build control monitoring to alert on drift immediately rather than before audits.
- Manage risk registers and third-party vendor risk programs with real tiering.
- Maintain a customer-facing trust portal to reduce questionnaire load.
- Evaluate AI assurance frameworks like ISO/IEC 42001 and the EU AI Act.
What you'll need
- Personally owned at least two full SOC 2 Type II cycles as the accountable lead.
- Deep experience with ISO 27001 certification or running an effective ISMS.
- Ability to build and maintain automations against services like GCP and GitHub.
- Hands-on experience with compliance platforms such as Drata or Vanta.
- Strong judgment to distinguish real risk gaps from auditor formatting preferences.
- Excellent writing skills for auditors, engineers, executives, and security reviewers.
- Experience working in remote, fast-moving environments with shifting priorities.
Nice to have
- Exposure to AI governance frameworks like NIST AI RMF or EU AI Act.
- Previous experience at a security vendor or high-compliance company.
- Experience reviewing contract security alongside Legal teams.
- Background in building in-house compliance automation rather than buying tools.
Stack
- GCP
- GitHub
- Drata
- Vanta
How you'll work
- Fully remote position
- Quarterly team off-sites
- Reports directly to CISO
What you get
- Market competitive salary bands
- Meaningful equity program
- Comprehensive health benefits with 99% coverage
- Flexible time-off and winter shutdown
- Paid parental leave
Hiring process
- Informational chat with Talent Team
- Hiring Manager interview with CISO
- Working session on control automation and evidence pipeline design
- Cross-functional interviews with Engineering and Go-to-Market
- Debrief and final decision