[Hiring] Trust & Assurance Lead @Sysdig

Role Description

You'll own how Sysdig proves its security claims — to auditors, to enterprise customers, and to regulators — and you'll rebuild that function as engineering rather than paperwork. You'll also build one program from nothing: AI assurance, covering both our own AI systems and the AI questions now arriving in every enterprise deal.

• Maintain ISO 27001, ISO 27701, and SOC 2 Type II, moving entirely off point-in-time assessments.
• Make evidence collection a pipeline output: controls that report their own state, validation running continuously against production.
• This role is customer-facing; when a deal turns on a security answer, you're the person in the room.
• Report to the Director of Security Engineering, focusing on fixing control problems.
• This is a senior individual contributor role with the latitude to design and build the program you wished existed.
• Rebuild assurance as engineering: instrument controls, express policy as code, and detect control drift in near real time.
• Own the certification program end-to-end: ISO 27001:2022, ISO 27701:2019, and SOC 2 Type II.
• Drive down the cost of proof; labor per audit cycle should fall year over year.
• Build AI assurance from nothing, treating it as an engineering problem rather than a documentation exercise.
• Own AI third-party risk and decide what we accept.
• Run customer and partner assurance, leading high-consequence engagements.
• Write specifications that settle hard questions, ensuring defensibility under audit.
• Enable the field; sales engineers and account teams should answer most security questions without you in the room.
• Own the integrity of our public claims, catching stale reports and overstated scope.
• Push risk into engineering, turning findings into commitments or formal management responses.
• Be customer zero for assurance, using Sysdig's platform to produce evidence before customers do.
• Use agents to scale the function itself, ensuring repeatable tasks run without you.
• Represent Sysdig externally, engaging customer security teams and publishing your work.

Qualifications

• Have run a certification and audit program end-to-end for a cloud or SaaS company.
• Have shipped code or automation in service of a control objective — Python, Go, Terraform, CI pipelines, or an API.
• Have genuine depth in at least two of SOC 2, ISO 27001, ISO 27701, ISO 42001.
• Have demonstrated compliance with operational evidence to an enterprise customer's security team or auditor.
• Have a cloud-native technical foundation: Kubernetes, containers, at least one major cloud.
• Are already building with agentic tooling and have opinions about where it fails.
• Can differentiate between findings that matter and those that only matter to an auditor.
• Are credible with a customer's CISO and engineers.
• Are energized by problems where established principles don't fully apply.

Requirements

• Built an assurance or compliance function that didn't exist before.
• Worked on AI governance frameworks while the requirements were still moving.
• Built continuous controls monitoring or GRC engineering tooling.
• Worked assurance at a security vendor.
• Experience with public sector requirements, regulated financial services, or EU data protection.
• A track record of conference speaking, published research, or contribution to a control framework or open standard.

Benefits

• Extra days off to prioritize your well-being.
• 401(k) Retirement Savings Plan with a 3% company match.
• Maternity and Parental Leave.
• Mental health support for you and your family through the Modern Health app.
• Full health benefits package for you and your family.
• The U.S. annual salary range for this full-time position is between 160,000 and 200,000 USD/year.