Compliance & Security Lead

Role overview

Own security compliance and data protection for a software platform, keeping audit programs, customer assurance, and privacy processes running throughout the year. As the first dedicated compliance lead, you will work closely with founders, engineers, customers, and legal advisers to make requirements practical and reduce the burden on technical teams.

Responsibilities - Run SOC 2 and HIPAA compliance programs, coordinate audit evidence, and maintain audit readiness. - Complete customer security questionnaires and vendor assessments; provide relevant reports and keep the public trust information current. - Review and negotiate data processing agreements with legal support, maintain processing records, and handle UK and EU data subject requests. - Write and maintain security, privacy, and retention policies, and oversee retention practices. - Assess tools and subprocessors, maintain the approved list, and evaluate whether additional standards are needed. - Improve onboarding, incident and breach response readiness, and evidence collection through clear processes and automation.

Requirements - At least 5 years in security compliance, governance, risk and compliance, or data protection, ideally in SaaS or developer tools. - Experience as the first or sole compliance hire at an early-stage company, with broad ownership. - Hands-on experience running a SOC 2 audit from evidence gathering through final report. - Current working knowledge of UK and EU GDPR, including reviewing or negotiating data processing agreements. - Ability to complete security questionnaires accurately and promptly, and write policies in clear language for technical teams. - Enough technical knowledge to discuss cloud infrastructure, access controls, and logging with engineers; coding is not required. - Remote candidates must be within the time-zone range from CET to ET. The team meets in person three times per year.

Nice to have - Experience with ISO 27001 or HIPAA, compliance automation platforms, or AI-assisted compliance work. - A privacy or security certification, or the ability to work from the UK and attend a London office.

Benefits and work setup The role supports asynchronous work and remote home-office equipment. Benefits include private health insurance, 25 days of annual vacation plus public holidays, sick and parental leave, a learning budget, pension contributions, and equity.