SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Socket.dev is hiring a Compliance Engineering Lead to own compliance as an engineered system. This is a foundational, deliberately technical role reporting directly to the CISO. You will own the end-to-end compliance program, including SOC 2 Type II certification, ISO 27001 certification, risk management, vendor risk programs, and customer-facing assurance artifacts. You will hire and lead your first teammate focused on security questionnaires, RFPs, and contract security review.
Key responsibilities include: running the SOC 2 Type II observation window and auditor relationship; taking Socket through ISO 27001 certification and maintaining the ISMS; automating evidence collection from GCP, GitHub, identity providers, MDM, and ticketing systems; building control monitoring that alerts on drift; maintaining a risk register used by leadership; launching and maintaining a customer trust portal; and scoping Socket's AI assurance posture across ISO/IEC 42001, emerging AI agent standards, the EU AI Act, and NIST AI Risk Management Framework.
You should have personally owned at least two full SOC 2 Type II cycles as the accountable person, with deep ISO 27001 experience (certification or surveillance audits). You build automations against services (GCP, GitHub, etc.) and have hands-on experience with compliance platforms like Drata or Vanta. You can distinguish between real risk gaps and auditor formatting preferences, write clearly for auditors, security reviewers, engineers, and executives, and thrive in remote, fast-moving environments where priorities shift. Nice-to-haves include exposure to AI governance frameworks, security vendor experience, contract security review work, and in-house compliance automation building.
Socket's customers include Anthropic, xAI, Figma, and Vercel. The company has raised $125M+ in funding and was founded by Feross Aboukhadijeh, a long-time open source maintainer.
