Compliance Engineering Lead

Socket
United States
Workplace: RemoteFull timeFunction: Legal, Risk & ComplianceSkills: ["Ownership","Judgment","Prioritization","Cross-functional collaboration","Clear communication"]

Own compliance as an engineered system: lead SOC 2 Type II end-to-end, drive Socket through ISO 27001 certification and keep the ISMS alive. Build continuous, automated evidence pipelines pulling from systems of record (including GCP and GitHub) and monitor for drift. Run risk and third-party vendor programs, expand the customer trust portal, and scope AI assurance priorities across emerging standards.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
Socket
Socket
1 day ago

Compliance Engineering Lead

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 13 hours agoStatus: Live

Job Summary

Own compliance as an engineered system: lead SOC 2 Type II end-to-end, drive Socket through ISO 27001 certification and keep the ISMS alive. Build continuous, automated evidence pipelines pulling from systems of record (including GCP and GitHub) and monitor for drift. Run risk and third-party vendor programs, expand the customer trust portal, and scope AI assurance priorities across emerging standards.
Location: United States
Workplace: Remote
Employment Type: Full time
Job Function: Legal, Risk & Compliance
Seniority: Manager level

Key Responsibilities

  • •Own SOC 2 Type II end to end: run the observation window, manage the auditor relationship, scope the audit, and operate the evidence pipeline behind the report.
  • •Take Socket through ISO 27001 certification: define scope and ISMS, run gap assessment and internal audit, prepare the organization, and keep the ISMS alive after certification.
  • •Build continuous, automated evidence collection by pulling evidence from systems of record and implementing control monitoring that alerts on drift.
  • •Maintain risk management and third-party risk programs, including a risk register and vendor review/renewal cadence with an external security partner.
  • •Launch and maintain the customer-facing trust portal and build the assurance artifact library; scope Socket’s AI assurance posture against relevant standards.

Pay and Benefits

Perks:Health InsuranceEquityParental LeaveRemote Work

Key Requirements

  • •You have personally owned at least two full SOC 2 Type II cycles as the accountable person, including auditor relationship, scoping, evidence, and findings.
  • •You have ISO 27001 depth, including taking an organization through certification or running an ISMS through surveillance audits.
  • •You build compliance automations against services (e.g., scheduled jobs) and can automate evidence collection from systems of record.
  • •You have hands-on experience with compliance platforms such as Drata or Vanta and can explain where they add leverage versus “appearance of control.”
  • •You can write and communicate with auditors, enterprise security reviewers, engineers, and executives, while prioritizing real risk over formatting preferences.
Skills:OwnershipJudgmentPrioritizationCross-functional collaborationClear communication
Certifications:SOC 2 Type IIISO 27001
Tech Stack:GCPGitHubDrataVanta

Company Brief

Socket
Develops developer-focused tools and services to improve JavaScript/TypeScript package management, dependency workflows, and developer productivity for teams building modern web applications.
Industry: Developer Tools
Website