SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Reflection AI is a research lab building open AI models and making intelligence accessible to everyone. The Compliance and AI Governance function spans six pillars: AI Governance, Data Governance, Trade Compliance, Privacy Operationalization, Government Contracting Compliance, and Corporate Compliance.
You will be a senior generalist compliance professional who flexes across multiple pillars rather than owning a single lane. You'll take ambiguous, cross-cutting problems—new regulations, customer due-diligence requests, internal process gaps—and turn them into working programs: policies, SOPs, training, and monitoring. You'll serve as a force multiplier for pillar leads and a direct partner to the Head of Compliance and AI Governance.
Key responsibilities include:
- Standing up and maintaining compliance processes and SOPs across pillars (insider risk, background checks, external reporting, vendor/compliance tooling)
- Supporting security framework compliance posture (SOC 2, ISO 27001, NIST 800-53/800-171, CMMC) by maintaining evidence, coordinating with control owners, and prepping for audits and assessments
- Owning or supporting day-to-day Third-Party Risk Management (TPRM) operations: vendor security questionnaires, risk tiering, onboarding reviews, and tracking remediation of vendor findings
- Responding to inbound customer and partner security/compliance questionnaires, pulling in subject-matter owners as needed
- Partnering with pillar leads to fill gaps, cover surge work, and keep cross-pillar initiatives moving
- Drafting and maintaining policies, process documentation, and training materials for internal and external audiences
- Tracking regulatory developments (AI, data, privacy) and translating them into concrete internal workstreams
- Preparing materials for leadership and cross-functional updates (steering committees, exec reporting, knowledge-share sessions)
- Identifying process gaps and building scaffolding (trackers, templates, intake forms) to close them
Requirements:
- 4–7 years in compliance, risk, legal operations, or a related GRC (Governance, Risk, Compliance) function, ideally in tech or a regulated industry
- Direct experience with at least one security framework (SOC 2, ISO 27001, NIST) and with TPRM/vendor risk processes (questionnaires, risk tiering, onboarding review)
- Demonstrated ability to own a problem end to end with minimal supervision, across unfamiliar subject matter
- Strong written communication; comfortable turning ambiguous asks into clear policies and SOPs
- Experience working cross-functionally with Legal, Security, Privacy, People, and Engineering stakeholders
- Comfortable context-switching across multiple active workstreams
- Exposure to AI governance, data privacy (GDPR/CCPA), export controls (ITAR/EAR), or federal contracting compliance (CMMC, FAR/DFARS)
- Experience with GRC or compliance tooling (e.g., Vanta or similar platforms)
- Experience responding to customer-facing security questionnaires or supporting enterprise sales/procurement cycles
- Prior experience in a high-growth or startup environment where the compliance function is still being built
