SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 102,899 - 137,718 / annual
Sourcegraph is seeking a Compliance Manager to own and drive the company's governance, risk, and compliance (GRC) program with a primary focus on compliance. This is a highly cross-functional role working closely with Security, Engineering, IT, Legal, People, Sales, and other teams.
You will be responsible for maintaining and evolving Sourcegraph's compliance program, including owning certifications such as SOC 2 and ISO 27001, and preparing the company for additional frameworks as it scales. This role requires hands-on ownership of audit and certification programs end-to-end: designing and tailoring controls, collecting evidence, training internal teams, working directly with auditors, managing remediation, and driving follow-up work through completion.
Within one month, you will build strong working relationships across key stakeholders, develop a clear understanding of Sourcegraph's existing GRC program (ISMS, risk register, controls, certifications, audit processes), understand how SOC 2 and ISO 27001 programs operate, and begin identifying process improvements.
Within three months, you will take ownership of ongoing SOC 2 and ISO 27001 compliance programs, independently manage key audit activities (control testing, evidence collection, stakeholder coordination, auditor requests, findings, remediation), evaluate and tailor existing controls to Sourcegraph's environment, maintain the risk register and ISMS processes, help internal teams understand compliance responsibilities, and support customer-facing compliance activities.
Within six months, you will have led Sourcegraph through an audit or major certification milestone, own the GRC program's operating rhythm, establish a forward-looking compliance roadmap covering renewals, audits, new frameworks, and regulatory requirements, independently identify control gaps and drive remediation, and introduce automation or process improvements to reduce manual compliance work.
Sourcegraph's mission is to bring clarity and control to the world's most complex codebases. The company provides engineering organizations full visibility across their systems, precise context for AI agents, and the ability to execute coordinated code changes at scale. Customers include Stripe, Reddit, and Leidos. The company is backed by a16z, Sequoia, and Redpoint and operates as a globally distributed team.
Requirements:
- 5+ years of experience in governance, risk, compliance, information security compliance, or related role
- Demonstrated end-to-end ownership of SOC 2 and ISO 27001 programs, ideally within a SaaS, technology startup, or similarly fast-moving environment
- Experience personally managing external audits and certification processes, including audit preparation, evidence collection, control testing, stakeholder training, auditor interaction, remediation, and follow-up
- Strong understanding of risk management, control design, ISMS governance, and compliance program operations
- Experience adapting compliance controls to an organization's actual environment rather than applying generic or overly prescriptive requirements
- Familiarity with cloud-based technology environments and security/compliance considerations for distributed or remote workforces
- Strong project management and organizational skills with ability to drive cross-functional initiatives from inception through completion
- Excellent written and verbal communication skills; ability to explain compliance requirements clearly to technical and non-technical audiences
- Hands-on mindset and willingness to personally execute work required to keep compliance program operating effectively
- Curiosity about AI, automation, and emerging technology with interest in using new tools to improve compliance workflows
Nice-to-haves:
- Experience with additional security, privacy, or compliance frameworks (GDPR, HIPAA, HITRUST, FedRAMP, FISMA, PCI DSS, or related standards)
- Experience supporting security questionnaires, customer assurance processes, or sales-related compliance activities
- Experience with GRC platforms, compliance automation tools, or building internal automation for evidence collection and control monitoring
- Relevant certifications (CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, CRISC, or similar)
