Compliance Engineering Lead

Role overview

This job description has been rewritten in fresh language using the facts in the listing. Source credit and original listing details are available below.

Socket is hiring a full-time Compliance Engineering Lead for a remote role in the United States. The company builds tools that help developers and security teams find, audit, and manage open-source code; it says thousands of organizations use its product. Socket has raised $125 million and was founded by Feross Aboukhadijeh, an open-source maintainer.

Reporting to the CISO, you will own the compliance program as an engineered system, including SOC 2 Type II, the path to ISO 27001 certification, risk and vendor programs, and customer-facing assurance materials. The role emphasizes building and maintaining automated evidence pipelines and control monitoring, and includes deciding whether to keep, replace, or build upon the current compliance platform. You will also hire and lead an initial customer trust teammate focused on security questionnaires, RFPs, and contract security reviews with Legal.

The role will help determine Socket’s approach to AI assurance, including whether and how to address ISO/IEC 42001, AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework. The interview process includes a Talent Team conversation, an interview with the CISO, a working session on control automation and evidence pipelines, cross-functional interviews with Engineering and Go-to-Market, a debrief, and a decision and offer.

Socket lists market-competitive salary bands, equity, health coverage for employees and families at 99% coverage, flexible time off, holidays and a winter shutdown, paid parental leave, and a remote-first environment with quarterly team off-sites.

Role at a glance: Lead Socket’s compliance engineering program, including SOC 2, ISO 27001, automation, risk management, and customer assurance, reporting to the CISO.

Responsibilities mentioned in the listing

• Own SOC 2 Type II end to end, including the observation window, auditor relationship, audit scope, controls, evidence pipeline, and customer-facing report.
• Lead Socket through ISO 27001 certification by defining scope and the ISMS, conducting a gap assessment and internal audit, preparing the organization, and maintaining the ISMS after certification.
• Build and maintain automated evidence collection from systems including GCP, GitHub, the identity provider, MDM, and ticketing; develop scheduled control monitoring that detects drift and reduce recurring manual work.
• Run the risk program and maintain a risk register that informs leadership decisions; partner with the external security partner on vendor tiering, reviews, and renewal cadence.
• Own the customer-facing assurance program, including launching and maintaining a trust portal and creating an artifact library to reduce enterprise questionnaire volume.
• Assess AI assurance frameworks and regulations, including ISO/IEC 42001, AIUC-1, the EU AI Act, and the NIST AI Risk Management Framework, and advise on commitments and sequencing.
• Own the compliance platform decision, including evaluating the current platform and making the case for building compliance capabilities in-house where appropriate.

Qualifications stated in the listing

• Personally accountable for at least two complete SOC 2 Type II cycles, including auditor relationships, scoping, evidence, and findings; able to explain a failed control and how it was corrected.
• Experience taking an organization through ISO 27001 certification or managing an ISMS through surveillance audits; understands the difference between an operational ISMS and documentation prepared only for an audit.
• Able to build and maintain automations that work with services, and inclined to use scheduled jobs instead of recurring manual reminders; a software engineering background is not required.
• Hands-on experience with Drata, Vanta, or a comparable compliance platform, with informed views on where such tools help and where they can create only the appearance of control.
• Sound judgment in prioritizing genuine control risks against auditor preferences, and strong writing for auditors, enterprise security reviewers, engineers, and executives.
• Willingness to take ownership of unassigned work across Security, Engineering, Legal, and Go-to-Market.
• Experience in a remote, fast-moving environment where priorities change and the program is not fully defined.
• Preferred: exposure to AI governance frameworks such as ISO/IEC 42001, the NIST AI Risk Management Framework, or the EU AI Act; experience at a security vendor or another company subject to heightened customer scrutiny; contract security review with Legal; or in-house compliance automation experience.