Senior Compliance Engineer

Be the primary point of contact for external auditors; manage audit timelines and evidence collection

Own the risk assessment program — identify, assess, score, track, and report risks via a risk register

Manage vendor and third-party risk assessments and due diligence

Respond to customer and prospect security questionnaires (RFPs, due-diligence requests, trust-portal access) with accuracy and speed — a high-visibility, customer-facing part of this role

Support Sales and Customer Success on security & compliance calls with prospects and customers, translating technical controls into business language

Draft, maintain, and drive review of security policies and procedures

Track and report on compliance posture and drift to leadership

Partner with engineering and security teams to close compliance gaps pragmatically, balancing rigor with velocity

Use GRC tooling (e.g., Sprinto, Vanta, Drata, or similar) to automate evidence collection and monitoring

4+ years in GRC/compliance engineering or related roles (compliance, audit, information security)

Hands-on experience running SOC 2/ISO 27001 (or similar) audits end-to-end

Strong understanding of data protection & privacy — GDPR, HIPAA, PII/PHI handling

Proven ability to manage vendor/third-party risk assessments

Excellent written and verbal communication — comfortable presenting to and negotiating with external customers, auditors, and executives

Experience responding to customer security questionnaires / RFPs

Working knowledge of cloud environments (AWS) — enough to assess and discuss controls with engineering

Strong organizational skills — able to manage multiple audits and timelines independently

Experience with GRC automation platforms (Sprinto, Vanta, Drata, OneTrust)

Relevant certifications (CISA, CRISC, ISO 27001 Lead Auditor/Implementer, CIPP)

Experience in a B2B SaaS company handling enterprise customer data