Director, Security Compliance and Trust

Gomotive; United States; Remote; USD 225,000 - 305,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k)

Job summary

Gomotive seeks a senior leader to own compliance, privacy, and customer trust for a software platform serving transportation, logistics, and related sectors. Reporting to the CISO, the role blends policy writing, control design, audits, and direct customer engagement across global markets, with an AI-first governance model.

The role requires 8+ years in security compliance and demonstrated leadership of teams and international initiatives, including FedRAMP and privacy programs.

Qualifications

• Eight or more years in security compliance, GRC, privacy, audit, or risk management.
• Hands-on policy writing and control design experience.
• Experience standing up compliance/privacy in new international markets.
• FedRAMP experience or readiness.
• Concrete use of AI for compliance work with measurable outcomes.
• Experience owning customer-facing trust functions and leading globally distributed teams.

Responsibilities

• Lead governance, risk, and compliance end-to-end, including org design, hiring, framework selection, and risk decisions.
• Build a unified control framework mapping ISO 27001/27701, SOC 1 & SOC 2, PCI DSS, FedRAMP, GDPR, and CCPA/CPRA, with single-source evidence collection.
• Own the annual audit calendar, manage assessor relationships, and drive FedRAMP authorization from the ground up.
• Operate the privacy program: data subject rights, DPIAs, ROPA, cross-border transfers, and handling for sensitive driver data.
• Prepare regulatory readiness for new markets ahead of go-to-market, coordinating with Engineering on data residency and regional architecture.
• Represent security posture externally: own trust portal, respond to security questionnaires, and escalate in enterprise deals.
• Architect an AI-first operating model with evidence automation, continuous control monitoring, and AI-assisted responses.
• Stand up an AI governance program aligned with ISO/IEC 42001, NIST AI RMF, and EU AI Act for product and internal AI use.

Job description

Role overview

A senior leadership role owning the compliance, privacy, and customer-trust function for a software platform serving physical-operations customers across transportation, logistics, construction, energy, field service, and the public sector. Reporting to the Chief Information Security Officer, the position blends strategic program leadership with hands‑on policy writing, control design, audit fieldwork, and direct customer engagement. The role is expected to scale globally into Canada, the EU, Mexico, and South America, and to operate an AI-first governance model rather than a traditional GRC stack.

Responsibilities

• Lead governance, risk, and compliance end-to-end, including org design, hiring, framework selection, and the decision of where to accept versus remediate risk.
• Build a unified control framework that maps once across ISO 27001/27701, SOC 1 and SOC 2, PCI DSS, FedRAMP, GDPR, and CCPA/CPRA, with single-source evidence collection.
• Own the annual audit calendar, manage assessor relationships, and drive a FedRAMP authorization effort from the ground up as public-sector demand matures.
• Operate the privacy program: data subject rights, DPIAs, ROPA, cross-border transfers, and special handling for sensitive driver data such as location history, in‑cab video, telematics behavior, and biometric‑adjacent processing.
• Prepare regulatory readiness for new markets ahead of go‑to‑market, partnering with Engineering and Platform on data residency and regional architecture.
• Represent the security and privacy posture externally: own the trust portal, scale security questionnaire responses, and serve as the senior escalation point in enterprise deals.
• Architect an AI‑first operating model, personally building evidence automation, continuous control monitoring, and AI‑assisted questionnaire response.
• Stand up an AI governance program aligned with ISO/IEC 42001, the NIST AI RMF, and the EU AI Act, covering both product and internal AI use.

Requirements

• Eight or more years in security compliance, GRC, privacy, audit, or risk management, including five or more years leading people managers and senior individual contributors.
• Demonstrated hands‑on track record personally writing policies, designing controls, sitting in audits, and owning operational delivery rather than purely delegating.
• Experience standing up compliance and privacy in new international markets, ideally Canada, the EU, Mexico, or Latin America; familiarity with PIPEDA/Law 25, LGPD, or LFPDPPP is a strong plus.
• Experience with FedRAMP, ideally having led an organization through authorization or Moderate/High readiness.
• Concrete, demonstrated use of AI for compliance work such as evidence collection, questionnaire response, control monitoring, policy drafting, audit prep, or regulatory gap analysis, with measurable outcomes.
• Experience owning customer‑facing trust functions and leading globally distributed teams across multiple time zones.

Nice to have

• IPO readiness, SOX, or equivalent regulated‑environment experience, and prior work with sensitive personal data at scale.

Benefits and work setup

• Compensation range for United States‑based candidates: $225,000–$305,000, with total package potentially including equity. Benefits include health, pharmacy, dental, and vision coverage, paid and sick time, short‑and‑long‑term disability, life insurance, and 401k contributions, subject to eligibility. Some interviews or onboarding sessions may occur in person at global offices.