Compliance Manager

Reflection; New York (NY); Sur place; USD 120 000 - 180 000; Plein temps

Avantages offerts par ce poste

Top-tier compensation

Stock options

Health & wellness

Meals

Life & family

Vacation days

Sponsorship support

Team building

Résumé du poste

Reflection AI is seeking a senior compliance generalist who can flex across multiple pillars and turn ambiguous problems into working programs like policies, SOPs, training, and monitoring.

This role supports the Head of Compliance and AI Governance, helping to shape governance, risk management, and regulatory readiness across the org.

Qualifications

• 4-7 years in compliance, risk, legal operations, or a related GRC function, ideally in tech or a regulated industry
• Direct experience with at least one security framework (SOC 2, ISO 27001, NIST) and with TPRM/vendor risk processes
• Demonstrated ability to own a problem end to end with minimal supervision
• Strong written communication; turning ambiguous asks into clear policies and SOPs
• Experience cross-functionally with Legal, Security, Privacy, People, and Engineering
• Comfortable context-switching across multiple active workstreams
• Exposure to AI governance, data privacy (GDPR/CCPA), export controls (ITAR/EAR), or federal contracting compliance
• Experience with GRC or compliance tooling (e.g., Vanta)
• Experience responding to customer-facing security questionnaires or supporting enterprise cycles
• Prior experience in a high-growth startup environment where compliance is being built

Responsabilités

• Stand up and maintain compliance processes and SOPs across pillars, including risk, background checks, and vendor tooling
• Support security framework compliance posture (SOC 2, ISO 27001, NIST, CMMC) by maintaining evidence and prepping for audits
• Own or support day-to-day TPRM operations: vendor questionnaires, risk tiering, onboarding reviews, remediation tracking
• Respond to inbound customer and partner security/compliance questionnaires with SME input
• Partner with pillar leads to fill gaps and move cross-pillar initiatives forward
• Draft and maintain policies and training materials for internal/external audiences
• Track regulatory developments and translate them into internal workstreams
• Prepare materials for leadership and cross-functional updates
• Identify process gaps and build trackers, templates, intake forms to close them

Connaissances

Compliance program ownership

Security frameworks

TPRM/vendor risk

Cross-functional collaboration

Strong written communication

Context-switching

AI governance exposure

Data privacy

Export controls

GRC tooling

Outils

Vanta

Description du poste

Our Mission

Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all.

Role Overview

Reflection AI's Compliance and AI Governance function spans six pillars: AI Governance, Data Governance, Trade Compliance, Privacy Operationalization, Government Contracting Compliance, and Corporate Compliance. The team builds the policies, controls, and operating rhythms that let the company move fast while staying defensible with regulators, customers, and partners.

We're looking for a senior generalist who can flex across multiple pillars rather than own a single lane. You'll take ambiguous, cross-cutting problems (a new regulation, a customer due-diligence request, an internal process gap) and turn them into working programs: policies, SOPs, training, and monitoring. This role is a force multiplier for the pillar leads and a direct partner to the Head of Compliance and AI Governance.

What You'll Do

• Stand up and maintain compliance processes and SOPs across pillars (e.g., insider risk, background checks, external reporting process, vendor/compliance tooling)

• Support our security framework compliance posture (SOC 2, ISO 27001, NIST 800-53/800-171, CMMC) by maintaining evidence, coordinating with control owners, and prepping for audits and assessments

• Own or support day-to-day TPRM operations: vendor security questionnaires, risk tiering, onboarding reviews, and tracking remediation of vendor findings

• Respond to inbound customer and partner security/compliance questionnaires, pulling in subject-matter owners as needed

• Partner with pillar leads (AI Governance, Data Governance, Trade Compliance, Privacy, Gov Contracting) to fill gaps, cover surge work, and keep cross-pillar initiatives moving

• Draft and maintain policies, process documentation, and training materials for internal and external audiences

• Track regulatory developments (AI, data, privacy) and translate them into concrete internal workstreams

• Prepare materials for leadership and cross-functional updates (steering committees, exec reporting, knowledge-share sessions)

• Identify process gaps and build the scaffolding (trackers, templates, intake forms) to close them

What We're Looking for

• 4-7 years in compliance, risk, legal operations, or a related GRC function, ideally in tech or a regulated industry

• Direct experience with at least one security framework (SOC 2, ISO 27001, NIST) and with TPRM/vendor risk processes (questionnaires, risk tiering, onboarding review)

• Demonstrated ability to own a problem end to end with minimal supervision, across unfamiliar subject matter

• Strong written communication; comfortable turning ambiguous asks into clear policies and SOPs

• Experience working cross-functionally with Legal, Security, Privacy, People, and Engineering stakeholders

• Comfortable context-switching across multiple active workstreams

• Exposure to AI governance, data privacy (GDPR/CCPA), export controls (ITAR/EAR), or federal contracting compliance (CMMC, FAR/DFARS)

• Experience with GRC or compliance tooling (e.g., Vanta or similar platforms)

• Experience responding to customer-facing security questionnaires or supporting enterprise sales/procurement cycles

• Prior experience in a high-growth or startup environment where the compliance function is still being built

What We Offer:

We believe that to make intelligence open and accessible to all, you need to start at the foundation. Joining Reflection means building from the ground up as part of a talent-dense team. You will help define our future as a company, and help define the future of open foundational models.

We want you to do the most impactful work of your career with the confidence that you and the people you care about most are supported.

• Top-tier compensation: Salary and equity structured to recognize and retain our talent globally.

• Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options.

• Health & wellness: Comprehensive medical, dental, vision, and life, with an annual wellness allowance.

• Meals: Lunch and dinner are provided in the office daily.

• Life & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.

• Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K.

• Sponsorship support: We sponsor visas to help exceptional talent join our team and support long‑term immigration pathways where applicable.

• Team building: We have regular off‑sites, happy hours, and team celebrations.

Export Control Notice: This position may require access to technology or source code subject to the U.S. Export Administration Regulations. Any offer of employment for this role may be conditioned on the Company's ability to provide the candidate with access to such technology or source code in compliance with applicable U.S. export control laws, which may require the Company to seek government authorization.

Candidate and Employee Privacy Notice: We collect and process personal data about applicants for the purposes described in our Candidate and Employee Privacy Notice