[Hiring] Compliance and Documentation Lead @Deepgram

Role Description

Deepgram is looking for a Compliance and Documentation Lead to own the written and evidentiary backbone of our compliance program — privacy and security both — and the documents that auditors, enterprise customers, and our own engineers rely on to know what we actually do.

This is one seat covering both halves deliberately. You will own our privacy program's operational work — assessments, data flow maps, deletion and rights workflows, subprocessor reviews — and our security compliance obligations under SOC 2, ISO 27001, and PCI DSS, along with the security questionnaires, policies, and public posture documents that sit on top of them.

Writing is the core skill in this role, and we mean writing that survives a skeptical reader — an auditor, an enterprise security reviewer, a customer DPO, an engineer who knows the system better than you do.

This role reports to the Director of Information Security and works closely with Security Engineering, Legal, Research, and Solutions/Sales Engineering.

We are open on level. This is a senior individual-contributor role, and we will calibrate title, scope, and compensation to demonstrated experience.

Responsibilities

• Privacy program
  • Own customer and prospect privacy risk assessments, DPIAs, and transfer impact assessments end to end.
  • Be the technical voice in customer privacy reviews and vendor due diligence calls.
  • Build and maintain accurate data flow maps and records of processing across hosted, dedicated, and self-hosted deployments.
  • Own the operating model for our privacy controls: retention and deletion enforcement, DSAR and deletion workflows, consent and opt-out handling, de-identification and redaction.
  • Own the subprocessor and vendor privacy review process, and the artifacts behind our DPAs.
  • Translate GDPR, UK GDPR, CCPA/CPRA and other US state privacy laws, and emerging AI regulation into concrete requirements.
  • Partner with Legal on DPAs, SCCs, transfer mechanisms, and residency commitments for dedicated deployments.
• Security compliance and audit
  • Own audit evidence end to end for SOC 2, ISO 27001, and PCI DSS.
  • Own control mapping across frameworks and maintain the crosswalk.
  • Own security questionnaires and the security sections of RFPs.
  • Partner with Security Engineering to ensure evidence is generated once and reused.
• Documentation and enablement
  • Author and own the lifecycle of our internal policies and standards.
  • Own our public-facing posture documents.
  • Own the documentation system itself.
  • Design and run operational auditing and remediation workflows.
  • Run compliance and privacy training and enablement.

Qualifications

• Substantial experience in privacy operations, GRC, security compliance, or technical compliance documentation.
• Exceptional writer capable of turning a messy technical reality into an acceptable document.
• Demonstrated ownership of compliance operational systems at scale.
• Hands-on involvement in at least one formal audit — SOC 2, ISO 27001, or PCI DSS.
• Practical experience with GDPR and CCPA/CPRA, and a current view of AI regulation.
• Technically fluent and able to understand architecture diagrams and data flows.
• Able to hold your own with a Fortune 500 privacy team, security reviewer, or DPO.
• Startup-friendly judgment regarding questionnaire answers and policy needs.
• Bias toward building systems and templates.
• Comfortable with ambiguity and making defensible calls.

Nice to Have

• Certification such as CIPM, CIPT, CIPP/E, CISA, or ISO 27001 Lead Implementer/Auditor.
• Experience with compliance automation platforms and trust center tooling.
• Familiarity with AI governance frameworks and model documentation practice.
• Experience with ML/AI data pipelines and training-data governance.
• Compliance work in a hybrid model — multi-tenant SaaS alongside self-hosted or on-premise deployments.
• Comfort with SQL, light scripting, or AI tooling to pull and assemble evidence.
• Exposure to HIPAA or FedRAMP.

Notice

We're aware of individuals impersonating Deepgram recruiters. All legitimate Deepgram recruiting communication comes from an @deepgram.com email address. If you've received a message claiming to be Deepgram, please forward it to [email protected].