Compliance & Security Lead

Trigger.dev; Greater London; Híbrido; GBP 70.000 - 120.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Generous compensation and equity

Async working

Home office setup support

Health insurance (UK)

Descripción de la vacante

Trigger.dev is seeking its first Compliance & Security Lead to own security compliance and data protection. You will report to the founders and collaborate with engineering to scale our compliance program throughout the year.

You’ll drive SOC 2 and HIPAA programs, manage evidence collection in Oneleet, and streamline responses to security questionnaires and DPAs while aligning with UK and EU GDPR requirements.

Formación

• 5+ years in security compliance, GRC or data protection, ideally at a SaaS or developer tools company.
• Experience at an early-stage startup as the first or only compliance hire, with full ownership.
• Hands-on experience running a SOC 2 audit, from evidence collection through to the final report.
• Up-to-date working knowledge of UK and EU GDPR, and experience reviewing or negotiating DPAs.
• Experience completing security questionnaires accurately and quickly.
• Clear, plain writing – able to turn a policy into something engineers will read.
• Enough technical understanding to talk to engineers about cloud infrastructure, access control and logging (no code required).
• Remote candidates must be within CET to ET timezones; 3 in-person events yearly.

Responsabilidades

• Running our SOC 2 and HIPAA programs: owning SOC 2 audit, evidence collection in Oneleet, audit readiness all year.
• Using AI and automation to speed up compliance work, from drafting questionnaire answers to collecting evidence and reviewing policies.
• Completing security questionnaires and vendor assessments, sharing reports and bridge letters, and keeping the trust portal current.
• Reviewing and negotiating DPAs with customers and suppliers, coordinating with lawyers, keeping processing records up to date, handling data subject requests under UK/EU GDPR.
• Writing and maintaining security, privacy and data retention policies, ensuring retention periods are enforced.
• Reviewing new tools and sub-processors before adoption, keeping sub-processor list current.
• Deciding on new frameworks (ISO 27001, ISO 42001) and leading the project to certification.
• Onboarding training and automated evidence collection to keep compliance seamless for the team.
• Keeping incident response and breach notification plans ready and tested annually.

Conocimientos

Security compliance

GRC

Data protection

SaaS industry experience

Startup experience

Policy writing

Engineer liaison

Educación

No formal education requirement

Herramientas

Oneleet

Vanta

Drata

Descripción del empleo

About Trigger.dev

Trigger.dev is an open source platform used by developers to build production-grade AI agents. It's an SDK and the infrastructure to run agents reliably at scale, so teams can focus on the product instead of the plumbing.

Our Cloud product is a managed service where we deploy our users' code and auto-scale from zero to millions of executions. With the rise of AI, being able to offload async tasks reliably is a key part of any developer's toolkit: We're building the infrastructure to make that a reality.

About the position

We're looking for our first Compliance & Security Lead to own security compliance and data protection at Trigger.dev. You'll report to the founders, and work closely with engineering.

We already hold SOC 2 Type II, run our program through Oneleet, and publish a trust portal covering SOC 2, GDPR and HIPAA. Until now the founders and engineers have handled compliance alongside their day jobs. As we grow, customers send more security questionnaires, ask for more reports and negotiate more DPAs. Now we need somebody to own this, keep it running all year, and free our engineers to build.

You don’t need to be an engineer, but technical experience is a bonus. This role suits someone process-minded who likes making compliance practical, rather than just ticking boxes.

What you'll be doing

You'll do a variety of things including:

• Running our SOC 2 and HIPAA programs: owning our SOC 2 audit, managing evidence collection in Oneleet and keeping us audit-ready all year
• Using AI and automation to speed up compliance work, from drafting questionnaire answers to collecting evidence and reviewing policies
• Completing security questionnaires and vendor assessments, sharing our reports and bridge letters, and keeping our trust portal current
• Reviewing and negotiating DPAs with customers and suppliers, working with our lawyers, keeping our records of processing up to date and handling data subject requests under UK and EU GDPR
• Writing and maintaining our security, privacy and data retention policies, and making sure retention periods are enforced
• Reviewing new tools and sub-processors before we adopt them, and keeping our sub-processor list current
• Deciding when we need new frameworks, such as ISO 27001 or ISO 42001 (the AI management standard), and leading the work to get there
• Making compliance seamless for the team: onboarding training, simple processes and automated evidence collection wherever possible
• Keeping our incident response and breach notification process ready, and testing it each year

Requirements

You really need to have:

• 5+ years in security compliance, GRC or data protection, ideally at a SaaS or developer tools company
• Experience at an early-stage startup as the first or only compliance hire, with full ownership
• Hands-on experience running a SOC 2 audit, from evidence collection through to the final report
• An up to date working knowledge of UK and EU GDPR, and experience reviewing or negotiating DPAs
• Experience completing security questionnaires accurately and quickly
• Clear, plain writing - you can turn a policy into something engineers will read
• Enough technical understanding to talk to engineers about cloud infrastructure, access control and logging (you don't need to write code)
• If you are remote you must be within CET to ET timezones (GMT+1:00 to GMT-5:00). We will arrange 3 in-person events throughout the year

You'll be an amazing fit if you:

• Have experience with ISO 27001 or HIPAA
• Have used a compliance automation platform such as Oneleet, Vanta or Drata
• Hold a privacy or security certification, such as CIPP/E, CISA or CISSP
• Use AI tools to speed up questionnaires, evidence review and policy work
• Are based in the UK and able to join the team in London

About the team

• We are a small team with a flat hierarchy
• We encourage continuous learning and personal development
• Everyone operates autonomously; we trust you to get the job done, but to also quickly raise your hand if you need help
• We care about our customers and the open-source community
• Being a start-up, the work is challenging and fast-paced, but we also understand the importance of taking time off to recharge

Working at a Commercial Open Source Software company is more than just your day job

• Our code is public, so anyone can see how we build and run our platform. We want our security and compliance to be just as open.
• We publish our security reports and trust portal, so customers can check our work instead of taking our word for it.
• Customers trust us with their code and data. We’re open about how we protect it.

Benefits

• Generous compensation and equity - We hire the best talent and pay to reflect that. We also offer equity as a way to ensure everyone is invested in the success of the company.
• Async working - Need a heads-down day or meeting-free days to stay productive? No problem!
• Home office - We will help provide equipment for a comfortable setup so you're as productive at home as you are in the office.
• Health insurance - Private health insurance, with Vitality for our UK team.
• Dog and cat friendly office - Our London office welcomes four-legged colleagues.
• Generous vacation - We believe it's important to take time off. We encourage you to take your 25 days vacation excluding national holidays, plus sick leave and generous parental leave.
• Training budget - An annual budget to contribute towards learning such as purchasing books, an Audible subscription or online courses.
• Pension contributions - Enroll in our company pension scheme or we'll contribute directly to your private pension.