← All roles

Compliance Engineering Lead

Socket· Security
Apply on company site
RemoteFull-timePosted 2mo ago

About the role

Engineering-focused compliance leadership responsible for building and operating Socket's end-to-end compliance program (SOC 2 Type II, ISO 27001) and associated assurance surfaces, automated evidence pipelines, and AI/gov posture.

Responsibilities

  • Own SOC 2 Type II end to end. Run the observation window, the auditor relationship, and the evidence pipeline behind both. Scope the audit and make sure the controls we describe are the controls that actually run. You own the report our customers read.
  • Take Socket through ISO 27001 certification. Define the scope and the ISMS, run the gap assessment and internal audit, prepare the organization and get us certified. Then keep the ISMS alive as something the company uses rather than something the auditor visits.
  • Make evidence collection continuous, automated, and boring. Write and maintain automation that pulls evidence directly from the systems of record: GCP, GitHub, our identity provider, MDM, ticketing. Build control monitoring that alerts on drift the day it happens instead of surfacing it the week before an audit.
  • Turn risk management and vendor risk into working programs. Maintain a risk register that reflects the risks we actually carry and that leadership uses when making decisions. In partnership with our external security partner, run third party risk with real tiering, real reviews, and a renewal cadence that holds.
  • Own the customer-facing assurance surface. Launch and maintain our trust portal, and build the library of artifacts that answers enterprise buyers before they send a spreadsheet. Measure your success by how much questionnaire load disappears, not by how quickly it gets processed.
  • Scope our AI assurance posture. Evaluate what matters: ISO/IEC 42001, emerging AI agent assurance standards such as AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework. Inform which of these to commit to, in what order, and what it would take.

Qualifications

  • You have personally owned at least two full SOC 2 Type II cycles as the accountable person.
  • ISO 27001 depth. You have taken an organization through certification or run an ISMS through surveillance audits.
  • You build automations. Comfortable building and maintaining automations against services. You can operate with GCP, GitHub, Iru and other reaching for a scheduled job before a recurring calendar reminder.
  • Clear opinions about compliance platforms. Hands-on experience with Drata, Vanta, or similar, and specific views on where these tools create leverage and where they create the appearance of control.
  • The judgment to prioritize. You can tell the difference between a control gap that represents real risk and one that represents an auditor's formatting preference.
  • Writing that holds up in front of four audiences. Auditors, enterprise security reviewers, engineers, and executives.
  • The instinct to step toward unowned problems. Compliance at a company our size lives in those seams between Security, Engineering, Legal, and Go-to-Market.
  • Experience in a remote, fast-moving environment where priorities shift.

Skills

Required:SOC 2 Type II ownershipISO 27001 / ISMSAutomation & toolingCompliance platformsRisk management & vendor riskAudit-ready writingCross-functional collaboration
Nice to have:AI governance posture

Benefits

  • Market competitive salary bands
  • Meaningful equity program
  • Comprehensive health benefits for you and your family (99% coverage)
  • Flexible time-off, holidays, and winter shutdown to rest & recharge
  • Paid parental leave
  • Remote-first, with quarterly team off-sites
Last updated Aug 26, 2026. Interested? Apply on the company site.

About Socket

Company profileWebsite

More open roles at Socket