Compliance Engineering Lead

The posting, as Socket wrote it

About Us

Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers - from Anthropic to xAI, and Figma to Vercel - love Socket (just check out their tweets https://socket.dev/love to see for yourself!)

Founded by Feross Aboukhadijeh https://www.linkedin.com/in/feross/, a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised $ https://socket.dev/blog/series-b125M in funding https://socket.dev/blog/series-c from top angels, operators, and security leaders.

ABOUT THE ROLE

We are hiring a Compliance Engineering Lead to own compliance as an engineered system rather than a calendar of reminders.

Socket sells to security teams. Our customers ask harder questions than most buyers ask, and they are right to. That means our SOC 2 Type II, our path to ISO 27001, our risk and vendor programs, and the assurance artifacts we put in front of enterprise buyers all have to be genuinely well run, not merely present. The credibility of what we sell depends on it.

This is a foundational role, and it is deliberately an engineering role. The person we want does not manage compliance by chasing people for screenshots. They write code against APIs, build control tests that run on a schedule and fail loudly, and treat evidence collection as a pipeline with an owner and an SLA. You will own the compliance platform decision, including whether the platform we use today is the right one. If your answer is that we should build more of it ourselves, make that case.

You will report directly to the CISO, own the compliance program end to end, and hire and lead your first teammate, a customer trust hire focused on security questionnaires, RFPs, and contract security review with Legal. You will shape what GRC at Socket becomes.

WHAT YOU'LL DO

• Own SOC 2 Type II end to end. Run the observation window, the auditor relationship, and the evidence pipeline behind both. Scope the audit and make sure the controls we describe are the controls that actually run. You own the report our customers read.
• Take Socket through ISO 27001 certification. Define the scope and the ISMS, run the gap assessment and internal audit, prepare the organization and get us certified. Enterprise customers are asking for this now. Then keep the ISMS alive as something the company uses rather than something the auditor visits.
• Make evidence collection continuous, automated, and boring. Write and maintain automation that pulls evidence directly from the systems of record: GCP, GitHub, our identity provider, MDM, ticketing. Build control monitoring that alerts on drift the day it happens instead of surfacing it the week before an audit. Every recurring manual task you inherit is a candidate for deletion.
• Turn risk management and vendor risk into working programs. Maintain a risk register that reflects the risks w

[…]
NIST AI RMF, EU AI Act); experience at a security vendor or another company held to a higher bar by its own customers; contract security review alongside Legal; having built compliance automation in-house rather than buying it.

OUR INTERVIEW PROCESS

• Informational with a member of our Talent Team
• Hiring Manager interview with our CISO
• Working session: walk us through a control you automated, and design an evidence pipeline with us
• Cross-functional interviews with Engineering and Go-to-Market
• Debrief
• Decision and offer

Hiring is a big decision on both sides. Read more about our Hiring Philosophy https://socket.dev/hiring-philosophyand how we approach the process at Socket.

Benefits: Our benefits are crafted to support you and your family, so you can take care of what matters most and thrive in and outside of work. We offer:

• Market competitive salary bands
• Meaningful equity program
• Comprehensive health benefits for you and your family (99% coverage)
• Flexible time-off, holidays, and winter shutdown to rest & recharge
• Paid parental leave
• Remote-first, with quarterly team off-sites

At Socket, we

• Pursue Excellence: We set ourselves apart by consistently delivering work of exceptional quality and distinction.
• Move with urgency and focus: We prioritize swift, decisive action.
• Think rigorously: We care about being right and it often takes reasoning from first principles to get there. We value alternative perspectives and have constructive discussions.
• Trust and amplify: We overtrust, always assume good intent, and give specific feedback to help each other improve.
• Feel a strong sense of ownership: We wear many hats and feel a strong sense of overall ownership of the company and we're non-territorial regarding our nominal domains.
• Are customer obsessed: We relentlessly prioritize the needs of our customers, striving to exceed their expectations and delight them at every interaction.