← All roles

GRC and Security Compliance Lead

Deepgram· Engineering
Apply on company site
Remote$179k - $223.3k + bonusFull-timePosted 2w ago

About the role

Lead the written and evidentiary backbone of the security and privacy program, owning policies, evidence, and public posture documents across multiple frameworks and deployment models.

Responsibilities

  • Own audit evidence end to end for SOC 2, ISO 27001, and PCI DSS — what evidence is required, who produces it, where it lives, and whether it would actually satisfy a reviewer. Be the auditor's primary point of contact through fieldwork.
  • Own control mapping across frameworks. Build and maintain the crosswalk so one control and one piece of evidence satisfies SOC 2, ISO 27001, PCI DSS, and customer questionnaires — rather than running the same work three times.
  • Own the colocation and infrastructure vendor side of compliance: datacenter provider SOC reports and attestations, physical security and carve-out language, and how shared responsibility actually divides between us and each provider.
  • Own security questionnaires and the security sections of RFPs. Maintain the answer library, keep it current as the product changes, and know which answers to fight for and which to concede.
  • Author and own the lifecycle of our internal policies and standards: drafting, review and approval cycles, annual review, exceptions and carve-outs, and retiring what no longer reflects reality.
  • Own our public-facing posture documents — Trust Center content, the AI Safety statement, Model Cards (with Research), the Privacy Policy (with Legal), and the deployment-model and self-hosted documentation customers rely on during review.
  • Own the documentation system itself: where documents live, how they are versioned and reviewed, and how a customer-facing claim traces back to an internal source of truth. Nothing we say publicly should be unattributable.
  • Maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments — and own the process that keeps them accurate as the product changes.
  • Run compliance and security awareness training and enablement, including clear guidance to Sales Engineering on what they may and may not commit to on a customer call.
  • Partner with Security Engineering so evidence is generated once, by automation — from Ansible, GitHub, and our logging and monitoring stack — and reused, and flag where a manual evidence pull should become an automated one.
  • Support the privacy program: contribute to DPIAs and transfer impact assessments, subprocessor and vendor privacy reviews, and DSAR intake, in partnership with the Privacy Operations Lead.

Qualifications

  • Substantial experience in GRC, security compliance, or technical compliance documentation — enough that you have carried at least one audit cycle end to end from the evidence side and owned the outcome.
  • Exceptional writer. This is the central requirement, not a soft skill. You can turn a messy technical reality into a document a skeptical auditor, customer, or engineer will accept.
  • Hands-on involvement in at least one formal audit — SOC 2, ISO 27001, or PCI DSS — as the person producing and defending evidence, not only as a reader of the report.
  • Experience mapping controls across more than one framework, and a real opinion about how to avoid duplicated compliance work.
  • Technically fluent and unintimidated: you can read an architecture diagram, follow a data flow through datacenter and cloud infrastructure, understand what a log line or a retention setting actually implies, and ask the question that exposes a gap — without needing someone to translate for you.
  • Startup-friendly judgment. You know which questionnaire answers are worth fighting for and which to concede, and when a policy needs a carve-out rather than a mandate.
  • Working knowledge of GDPR, CCPA/CPRA, and where AI regulation is heading — enough to write public posture documents that hold up.
  • Bias toward building systems and templates rather than becoming the person every request has to route through.
  • Comfortable with ambiguity and with making a defensible call when the standard is unsettled.

Skills

Required:GRC and security complianceTechnical writing for auditsAudit participation

Benefits

  • Offers Equity
  • Offers Bonus
  • 10% Annual Bonus
  • Tier 1 compensation includes base salary range and location-based adjustments: $179K – $223.3K (San Francisco, Seattle, NYC)
  • Tier 2 compensation: $165K – $206.2K (Everywhere else in US)
Last updated Oct 14, 2026. Interested? Apply on the company site.
Deepgram logo

About Deepgram

Building foundational AI for speech transcription and understanding.

Deepgram is a foundational AI company on a mission to understand human language. We give any developer access to the most advanced speech AI transcription and understanding with just an API call. Our models deliver the fastest, most accurate transcription alongside contextual features like summarization, sentiment analysis, and topic detection. Beyond that, developers can: 🔊 Process live-streaming or pre-recorded audio 🌎 Transcribe in dozens of languages ⚙️ Train custom models for unique use cases 🔑 Access deep NLU with a unified API 💻 Build in any programming language with our SDKs ✅ Deploy on-prem or on DG’s managed cloud 📈 Get scalable GPU infra for training and inference Deepgram is a proud NVIDIA partner and Y Combinator company, and we recently completed a $72M Series B to define the future of AI Speech Understanding, making us the most-funded speech AI company at its stage.

ai-enhanced-learningapiartificial-intelligencebrex-fastest-growing-2025liquid-ai-recruiting-targetspeech-to-texttext-to-speechvoice-ai-stack
Company profileWebsite

More open roles at Deepgram