Security Compliance Lead

Role overview Own and mature a security compliance program covering core certifications and governance obligations. You will set its roadmap, maintain a shared control framework, and lead audits and assurance work while partnering with Product, Engineering, Finance, and security leadership to incorporate compliance into business and product decisions.

Responsibilities - Lead SOC 2 Type 2, ISO 27001, and ISO 27701 programs through recurring audit cycles, coordinating evidence and governance reviews for policies, access, change management, training, vendors, and external assessments. - Maintain a common control catalog mapped across applicable frameworks, with assigned owners, regular certifications, and control testing. - Plan risk-based internal audits, assess operating effectiveness and policy adherence, manage policy lifecycles, and drive findings through remediation. - Partner with Finance and external auditors on IT general controls and SOX-related work. - Set the program roadmap and measurable KPIs, reporting progress and maturity to security leadership quarterly. - Work with Product and Engineering to assess how launches and infrastructure changes affect scope and boundaries, and build compliance checkpoints into product development; use automation to streamline evidence and audit tasks.

Requirements - Has owned SOC 2 Type 2 and ISO 27001/27701 programs across multiple audit cycles and set roadmaps and KPIs to mature them. - Has built or rebuilt a shared control framework mapped across multiple standards, including ownership and testing. - Hands-on FedRAMP experience (Revision 5 or 20x), including NIST 800-53 controls, system boundary and SSP documentation, third-party assessment, and continuous monitoring. - Experience running risk-based internal audits, testing controls and policy adherence, and resolving findings. - Experience working with Finance or internal controls teams and external auditors on ITGCs and SOX. - Experience managing recurring governance reviews and translating customer, bank, regulator, or government requirements into control and audit needs; able to partner with Product and Engineering on changes. - Demonstrated use of AI workflows or automation to materially reduce manual compliance work.

Nice to have - Familiarity with EU financial services requirements such as DORA, central bank technology and cyber assessments, or FCA reporting, or with bank-consortium assessments.