Summary
What you’ll impact
The Senior Security Compliance Engineer owns the assurance program, handling SOC 2, ISO 27001, and AI‑agent certifications. They build a unified controls library and run assurance pipelines with infrastructure‑as‑code and standards like ISO 42001 and NIST AI RMF. Key duties include managing auditor relationships, maintaining the enterprise risk register, and converting AI regulatory mandates into enforceable policies. Collaboration spans legal, product, and engineering teams to deliver risk narratives and guide compliance best practices for leadership.
Responsibilities
What you'll do
- You will own the organization’s assurance program end to end: certifications, AI governance, and the risk decisions leadership acts on.
- Own our SOC 2 Type II, ISO 27001, and ISO/IEC 42001 certifications: recertification cycles, auditor relationships, and remediation, run off continuously collected evidence — and expand the audit boundary as new products, entities, and acquisitions come into scope.
- Own the AI-agent assurance roadmap: track the emerging agent‑certification standards and get us certified for the agents we ship.
- Design and maintain a unified controls library mapped across frameworks so one control satisfies many obligations.
- Be the authoritative source behind the Customer Trust team: your certifications, control descriptions, and evidence feed the trust portal and response library they run.
- Operate the AI governance program: the AI system and agent inventory, risk classification, and alignment to NIST AI RMF.
- Track the AI regulatory landscape (EU AI Act provider and deployer obligations, US state AI laws, bar and professional‑responsibility guidance for legal AI) and translate it into concrete controls with Legal.
- Own the enterprise risk register: risk assessments, treatment decisions with system owners, and risk reporting leadership actually uses.
- Own the policy lifecycle, and turn written policies into enforced checks with the AI GRC Engineer wherever a rule can be automated.
- Consume the supply‑chain‑risk program’s vendor assessments for compliance scope; vendor risk itself is owned by the Supply Chain Risk Lead.
- Own the BCDR program: business impact analysis, recovery objectives with Engineering, and regular tabletop exercises and recovery tests.
Requirements
What you’ll bring
- 6+ years in GRC, security compliance, or IT audit, including at least one B2B SaaS environment where you owned SOC 2 and/or ISO 27001 end to end.
- Working knowledge of AI governance frameworks (ISO 42001, NIST AI RMF) and the EU AI Act, or a demonstrated ability to get deep in a new regulatory domain fast.
- A continuous-assurance operating model: you have run (or built toward) monitored controls and pipeline-collected evidence, and treat compliance platforms as plumbing rather than the program.
- Ability to read code and infrastructure-as-code well enough to verify a control yourself.
- Experience running enterprise risk processes that leadership uses to make decisions.
- Clear, precise writing — you will produce policies and risk narratives read by lawyers.
- You use AI tools daily in your own work and have specific, grounded views on which GRC workflows AI can run today and which it cannot.