Compliance Lead (part-time, contractor)

Soda; New York (NY); Remote; USD 78,000 - 134,000; Part time

Benefits offered by this job

Real mandate to build a modern, AI‑dr,

Live enterprise projects with major by

Runbooks and scheduling system for due

AI-forward company that funds what you

Direct access to decision-makers

Competitive contractor rate

Job summary

Soda is expanding its compliance function and seeking a part-time, remote compliance lead to own SOC 2 Type II and SOC 3 cycles, drive automation, and modernize evidence gathering. You’ll implement AI-assisted workflows, design pragmatic controls, and collaborate with engineering, product, and sales to keep security rigorous without slowing growth.

You will operate across AWS, Okta, GitHub, and other systems, ensuring audit readiness, efficient responses to questionnaires, and ongoing program

Qualifications

• 3+ years in security compliance / GRC, ideally at a B2B SaaS company.
• Hands-on with SOC 2 Type II cycles and interaction with external auditors.
• Experience with compliance automation platforms and building AI-assisted workflows.
• Ability to design controls for a fast-growing product company while staying audit-ready.

Responsibilities

• Own and run the annual SOC 2 Type II and SOC 3 cycle with external auditors.
• Keep the control set audit-ready year-round and chase lapses or failures.
• Run people compliance during onboarding/offboarding, security training, and policy adherence.
• Partner with Sales to support enterprise security reviews and avoid over-promising.

Skills

SOC 2

GRC

Automation

AI workflows

Policy writing

Security awareness

English proficiency

Education

CISA/CISM/CIPP/E or ISO 27001 Lead Implementer

Tools

Drata

Vanta

Secureframe

AWS

Okta

GitHub

Job description

About Soda

At Soda, we're on a mission to bring everyone closer to their data. We believe that all data stakeholders (and we think that's everyone) should be able to understand it, trust it, and stay on top of it. We're pioneering the fastest-growing category in the data and analytics space, known as data quality and observability. We allow teams to discover, prioritize, and collaboratively resolve data issues. Our integrated platform brings everyone closer to the data, resulting in data products and analytics everyone can trust.

About Soda

At Soda, we're on a mission to bring everyone closer to their data. We believe that all data stakeholders (and we think that's everyone) should be able to understand it, trust it, and stay on top of it. We're pioneering the fastest-growing category in the data and analytics space, known as data quality and observability. We allow teams to discover, prioritize, and collaboratively resolve data issues. Our integrated platform brings everyone closer to the data, resulting in data products and analytics everyone can trust.

We are an international team, headquartered in Brussels, Belgium and dispersed globally. Our customers are enterprises (banks, insurers, retailers and utilities), so security compliance isn't paperwork for us. It's part of how we win deals and keep them.

The job

We're looking for someone to own Soda's compliance function and keep building it. We've already built a strong foundation: we've been running a SOC 2 cycle since 2021, and have been making strides in automating and professionalizing the entire compliance process in the past year. But we aren't where we want to be yet. You will be pushing this further: maximizing automation and streamlining processes, so we get even better compliance, while minimizing time our engineers and ops team have to spend on manual execution and evidence gathering. Soda's product and operations are evolving at lightning speed. You will be the person to find pragmatic ways to make sure we keep our compliance commitments without slowing us down.

What You'll Do

Build the structure. Roughly half of this job is making compliance at Soda easier and more reliable to run:

• Push the automation of our compliance program as far as it can go. We've already got a compliance automation platform, lots of controls are already fully or partially automated. Your job is to take that even further. Every minute you give back to our engineers by taking away manual tasks is a minute they can spend building a better product instead
• Build compliance that enables the future. Soda is leveraging the massive capabilities of AI both in its product and in its internal operations. Our processes and controls need to keep up with the new world. You will adapt our compliance posture to this fast pace of change, with pragmatic solutions that keep/improve our compliance commitments without dragging down our speed in the market
• Make our RFP and security-questionnaire answering hyper efficient. Compliance and security are important topics in every RFP and supplier due diligence process. You will make sure this is handled as efficiently as possible, using and expanding our existing tooling and making sure the most up-to-date references are used at all times

And make it run. The other half is the programme itself, which has to stay audit-ready while you improve it:

• Own the annual SOC 2 Type II and SOC 3 cycle with our external auditor: planning, access, samples, our part of the report, and closing out findings
• Keep the control set audit-ready all year: watch what's lapsing, chase what's failing, make sure nothing falls through the cracks
• Run people compliance: the compliance steps in onboarding and offboarding, plus the yearly security training, code of conduct, incident-reporting and phishing cycles
• Be Sales' compliance partner in enterprise security reviews, unblocking deals without promising things we don't do

Who we're looking for

You've run a SOC 2 program or similar before at a SaaS company. You're comfortable being the only compliance person in the room and pragmatic about designing controls that work for a company our size. First, a lot of it is getting busy engineers to do something on time and prove they did it. You need to manage that, and find ways of making this as low-friction as possible for everyone involved. Second, you have to be able to build: not production software, but scripts, integrations, prompts, and AI-assisted workflows that hold up under an auditor's questions.

Because it's part-time and remote, we need someone predictable and self-directed, who runs their own agenda and flags early when something needs a decision from us.

Requirements

• 3+ years in security compliance / GRC, ideally at a B2B SaaS company
• You have run a SOC 2 Type II cycle hands-on, including working directly with an external auditor through scoping, sampling and remediation
• Hands-on with a compliance automation platform: Drata ideally, or Vanta / Secureframe. You know what these tools genuinely automate and where they still need a person
• Comfortable designing and implementing automations, including with AI
• Comfortable with the systems these controls run against: AWS, Okta, GitHub, endpoint management. Enough to judge whether evidence is real, not just whether a file was uploaded
• Comfortable answering enterprise security questionnaires and holding your own live in a customer security review
• Clear written and spoken English, and the judgement to write a policy people can actually follow
• Available roughly 2-3 days per week, with solid working-hours overlap with CET
• Must be working in an EU time zone
• Able to invoice as a freelancer / contractor

Nice to have

• Technical experience
• Experience in a company under 200 people, where compliance is one person plus a lot of automation
• ISO 27001 experience
• A certification such as CISA, CISM, CIPP/E or ISO 27001 Lead Implementer

Benefits

• A real mandate to build a modern, forward-looking compliance system that keeps pace with and leverages opportunities created by the new AI reality
• A live, certified programme with enterprise customers depending on it, with full freedom to implement improvements
• A documented starting point: runbooks for every manual control, a scheduling system that tells you what's due, and a full written handover from your predecessor
• An AI-forward company that will actually fund and use what you build
• Direct access to decision-makers; no layers between you and the people who can fix things
• A competitive contractor rate