[Hiring] Compliance Engineering Lead @Socket

Role Description

We are hiring a Compliance Engineering Lead to own compliance as an engineered system rather than a calendar of reminders. This is a foundational role, and it is deliberately an engineering role. The person we want does not manage compliance by chasing people for screenshots. They write code against APIs, build control tests that run on a schedule and fail loudly, and treat evidence collection as a pipeline with an owner and an SLA. You will own the compliance platform decision, including whether the platform we use today is the right one. If your answer is that we should build more of it ourselves, make that case.

You will report directly to the CISO, own the compliance program end to end, and hire and lead your first teammate, a customer trust hire focused on security questionnaires, RFPs, and contract security review with Legal. You will shape what GRC at Socket becomes.

What You'll Do

• Own SOC 2 Type II end to end.
• Run the observation window, the auditor relationship, and the evidence pipeline behind both.
• Scope the audit and ensure the controls we describe are the controls that actually run.
• Take Socket through ISO 27001 certification.
• Define the scope and the ISMS, run the gap assessment and internal audit, prepare the organization and get us certified.
• Make evidence collection continuous, automated, and boring.
• Turn risk management and vendor risk into working programs.
• Own the customer-facing assurance surface.
• Scope our AI assurance posture.

Qualifications

• You have personally owned at least two full SOC 2 Type II cycles as the accountable person.
• ISO 27001 depth.
• You build automations.
• Clear opinions about compliance platforms.
• The judgment to prioritize.
• Writing that holds up in front of four audiences: Auditors, enterprise security reviewers, engineers, and executives.
• The instinct to step toward unowned problems.
• Experience in a remote, fast-moving environment.

Nice to Have

• Exposure to AI governance frameworks (ISO/IEC 42001, NIST AI RMF, EU AI Act).
• Experience at a security vendor or another company held to a higher bar by its own customers.
• Contract security review alongside Legal.
• Having built compliance automation in-house rather than buying it.

Benefits

• Market competitive salary bands.
• Meaningful equity program.
• Comprehensive health benefits for you and your family (99% coverage).
• Flexible time-off, holidays, and winter shutdown to rest & recharge.
• Paid parental leave.
• Remote-first, with quarterly team off-sites.