SaaS Security & Compliance Lead (SOC 2, HIPAA, GDPR)

Trigger.dev; Greater London; Hybrid; GBP 70,000 - 120,000; Full time

Benefits offered by this job

Generous compensation and equity

Async working

Home office setup support

Health insurance (UK)

Job summary

Trigger.dev is seeking its first Compliance & Security Lead to own security compliance and data protection. You will report to the founders and collaborate with engineering to scale our compliance program throughout the year.

You’ll drive SOC 2 and HIPAA programs, manage evidence collection in Oneleet, and streamline responses to security questionnaires and DPAs while aligning with UK and EU GDPR requirements.

Qualifications

• 5+ years in security compliance, GRC or data protection, ideally at a SaaS or developer tools company.
• Experience at an early-stage startup as the first or only compliance hire, with full ownership.
• Hands-on experience running a SOC 2 audit, from evidence collection through to the final report.
• Up-to-date working knowledge of UK and EU GDPR, and experience reviewing or negotiating DPAs.
• Experience completing security questionnaires accurately and quickly.
• Clear, plain writing – able to turn a policy into something engineers will read.
• Enough technical understanding to talk to engineers about cloud infrastructure, access control and logging (no code required).
• Remote candidates must be within CET to ET timezones; 3 in-person events yearly.

Responsibilities

• Running our SOC 2 and HIPAA programs: owning SOC 2 audit, evidence collection in Oneleet, audit readiness all year.
• Using AI and automation to speed up compliance work, from drafting questionnaire answers to collecting evidence and reviewing policies.
• Completing security questionnaires and vendor assessments, sharing reports and bridge letters, and keeping the trust portal current.
• Reviewing and negotiating DPAs with customers and suppliers, coordinating with lawyers, keeping processing records up to date, handling data subject requests under UK/EU GDPR.
• Writing and maintaining security, privacy and data retention policies, ensuring retention periods are enforced.
• Reviewing new tools and sub-processors before adoption, keeping sub-processor list current.
• Deciding on new frameworks (ISO 27001, ISO 42001) and leading the project to certification.
• Onboarding training and automated evidence collection to keep compliance seamless for the team.
• Keeping incident response and breach notification plans ready and tested annually.

Skills

Security compliance

GRC

Data protection

SaaS industry experience

Startup experience

Policy writing

Engineer liaison

Education

No formal education requirement

Tools

Oneleet

Vanta

Drata

Job description

Trigger.dev is seeking its first Compliance & Security Lead to own security compliance and data protection. You will report to the founders and collaborate with engineering to scale our compliance program throughout the year.

You’ll drive SOC 2 and HIPAA programs, manage evidence collection in Oneleet, and streamline responses to security questionnaires and DPAs while aligning with UK and EU GDPR requirements.