Socket
Compliance Engineering Lead
United States · Remote · Full-time · Posted Aug 26, 2026
- Experience
- At least two full SOC 2 Type II cycles owned; ISO 27001 certification experience or experience running an ISMS through surveillance audits.
About the job
Own and engineer Socket’s compliance program, including SOC 2, ISO 27001, risk and vendor programs, automated evidence collection, customer assurance, and AI assurance planning.
What you'll do
- Own SOC 2 Type II and its audit, observation window, scoping, and evidence pipeline; lead Socket through ISO 27001 certification and maintain its ISMS.
- Automate evidence collection and control monitoring, and run risk management and vendor risk programs.
- Own customer-facing assurance, hire and lead a customer trust teammate, and evaluate AI assurance frameworks and regulations.
What they ask for
- Personally owned at least two full SOC 2 Type II cycles, including the auditor relationship, scoping, evidence, and findings.
- Taken an organization through ISO 27001 certification or run an ISMS through surveillance audits.
- Build and maintain automations against services; have hands-on experience with Drata, Vanta, or similar compliance platforms.
- Experience in a remote, fast-moving environment where priorities shift and the program is not fully defined.
Nice to have
- Exposure to AI governance frameworks, experience at a security vendor or a company held to a higher bar by its customers, contract security review alongside Legal, or in-house compliance automation.
Tools
GCP, GitHub, Iru, Drata, Vanta, ISO/IEC 42001, AIUC-1, NIST AI Risk Management Framework
AI focus
Evaluate AI assurance frameworks and regulations, including ISO/IEC 42001, AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework, and advise which to adopt, in what order, and what implementation requires.
Model-written summary · the original posting is authoritative