Senior Technical Compliance Analyst

Job Description

We are seeking a hands-on, builder-minded Senior Technical Compliance Analyst to serve as the operational engine behind our Trust & Security program.

You will maintain our SOC 2 Type II posture, drive our second entity from Type I to Type II, and act as the bridge between compliance requirements and engineering & delivery execution. You will also lay the technical groundwork to evolve us toward CMMC 2.0, ensuring readiness for federal contracts without slowing down product velocity.

Responsibilities

Powering Customer Trust & Revenue Enablement

• Help draft accurate, technically precise responses to RFPs, security questionnaires (CAIQ, SIG, custom risk assessments), and customer portals.
• Own and continuously update the "Library of Truth"—a repository of pre-vetted security evidence, technical configurations, and policy documents.
• Retrieve granular technical evidence (e.g., AWS KMS encryption, logging pipelines, IAM privilege escalation paths) and draft narratives for Security and Legal teams.

Building Compliance into the DNA

• Partner with IT, Security, Product, Engineering, and Delivery early in the development lifecycle to influence architecture and ensure compliance by design.
• Write, update, and operationalize security policies (IAM hardening, log retention, Zero Trust implementation).
• Automate policy enforcement in CI/CD pipelines where possible.
• Conduct lightweight compliance enablement sessions with engineering teams for self-serve evidence collection.

Operational GRC & Audit Excellence

• Drive and coordinate end-to-end SOC 2 Type I and Type II audit cycles across business entities.
• Serve as a power-user of modern GRC platforms to automate evidence collection and continuous control monitoring.
• Manage the compliance ticketing queue in Jira, quarterly User Access Reviews (UAR), security awareness training, phishing simulations, and Risk Acceptance/Exceptions.
• Build and maintain compliance dashboards (KPIs/KRIs) tracking audit readiness, SLAs, and control health.
• Manage the annual policy review and attestation cycle.

Future Federal & Supply Chain Roadmap

• Assist in aligning controls with federal standards (NIST SP 800-53, NIST SP 800-171 Rev 3, FedRAMP, and CMMC 2.0) and drafting System Security Plans (SSPs) and POA&Ms.
• Own third-party vendor review processes to meet strict supply chain requirements.
• Support the Security Team during security incidents by preserving audit evidence and drafting post-incident reports.

Qualifications

• Experience: 7+ years of experience in technical compliance, IT audit, or GRC within a SaaS or fast-paced startup environment.
• Audit Mastery: Proven end-to-end experience supporting external SOC 2 Type I and Type II audits, with specific expertise auditing IT General Controls (ITGC).
• Technical Acumen: Strong understanding of modern cloud infrastructure (AWS/GCP/Azure), IAM, CI/CD pipelines, encryption standards, and vulnerability management. Ability to read Terraform plans or AWS Config rules.
• Tooling: Experience operating automated compliance platforms (Vanta, Drata), Jira, and security awareness platforms (KnowBe4).
• Mindset & Communication: Ability to negotiate secure alternatives ("Yes, if..." approach) and exceptional written and verbal communication skills.

Work Arrangement

This role is Hybrid Only: 3 days a week in either our San Francisco, CA or New York City, NY office.