Enterprise GRC & Compliance Manager

Decagon; San Francisco (CA); Hybrid; USD 190,000 - 275,000; Full time

Benefits offered by this job

Medical, Dental, and Vision benefits

Life Insurance and Disability Benefits

Retirement Plan (e.g., 401K, pension)

Parental Leave

Fertility and family building benefits

Monthly wellness stipend

Daily lunches and snacks in the office

Take what you need vacation policy

Job summary

Decagon is seeking a Compliance Manager to lead the day-to-day execution of our compliance program and customer security engagements as we scale to serve Fortune 500 and international enterprises. You will manage security communications with customers, support audits, and improve security documentation, ensuring rigorous regulatory alignment and trusted enterprise partnerships.

Work closely with head of security and compliance, engineering, product, and legal teams to coordinate responses to

Qualifications

• 3–5 years of GRC experience in high-growth SaaS or tech companies.
• Proven track record contributing to SOC 2, ISO 27001, or similar enterprise certifications.
• Experience in data privacy regulations including CCPA, GDPR, and AI governance frameworks.
• Strong project management skills coordinating cross-functional teams under tight deadlines.
• Excellent written and verbal communication to translate security concepts for diverse audiences.
• Working knowledge of technical security controls and collaboration with engineering teams.

Responsibilities

• Drive compliance certifications including SOC 2 Type II, ISO 27001, PCI DSS, HIPAA, and CCPA.
• Automate or execute compliance evidence collection, ensuring controls are documented and audit-ready.
• Maintain and improve security documentation including policies, procedures, and customer-facing security collateral.
• Support customer security assessments by preparing materials for security reviews and addressing inquiries from Fortune 500 teams.
• Manage security and compliance topics in RFPs end-to-end across engineering, product, and legal teams.
• Coordinate with contractors and vendors to maintain response quality and meet timelines during peak sales periods.
• Build and optimize repeatable processes to scale our GRC operations for hundreds of enterprise customers.
• Partner with sales engineering to understand customer security requirements and prepare responses.
• Partner with Sales and Customer Success to address security concerns with published content.
• Collaborate with Security, Engineering, and Product teams to translate requirements into technical controls.
• Establish vendor risk management programs to monitor third-party security risks across our supply chain.

Skills

GRC experience

SOC 2 / ISO 27001

Data privacy regulations (CCPA, GDPR)

Project management

Security concepts communication

Technical security controls knowledge

Tools

Vanta

Drata

SecureFrame

Job description

About Decagon

Decagon is the leading conversational AI platform empowering every brand to deliver concierge customer experiences.

Our technology enables industry-defining enterprises like Avis Budget Group, Block’s Cash App and Square, Chime, Oura Health, and Hunter Douglas to deploy AI agents that power personalized, deeply satisfying interactions across voice, chat, email, SMS, and every other channel.

We’re building a future where customer experiences are being redefined from support tickets and hold music to faster resolutions, richer conversations, and deeper relationships. We’re proud to be backed by world-class investors who share that vision, including a16z, Accel, Bain Capital Ventures, Coatue, and Index Ventures, along with many others.

We’re an in-office company, driven by a shared commitment to excellence and velocity. Our values — Just Get It Done, Invent What Customers Want, Winner’s Mindset, and The Polymath Principle — shape how we work and grow as a team.

About the Team

The Security Engineering team at Decagon protects the platform that powers the most advanced conversational AI agents for enterprise customers across voice, chat, email and SMS. We build the security foundations that enable Decagon's AI agents to handle sensitive customer data with complete trust while defending against sophisticated, AI-enabled threats at massive scale.

Our mission is to secure magical support experiences, ensuring that AI agents and human agents can collaborate safely to help users resolve their issues while maintaining the highest standards of security and privacy.

About the Role

Join Decagon as a Governance, Risk, and Compliance Manager and play a critical role in securing customer trust as we scale to serve Fortune 500 and international enterprises. Working closely with the head of security and compliance, you'll be responsible for the day-to-day execution of our compliance program and customer security engagements. This is a high-impact role where you'll directly contribute to closing enterprise deals by efficiently managing security communications with customers, supporting compliance audits, and improving our security documentation. Perfect for someone who thrives in a high impact organization with attention to detail, excellent writing skills, and who wants to build expertise in enterprise AI compliance.

In this role, you will

• Own our route to FedRAMP compliance, with experience on both 20x and traditional Rev 5 approach. Partner heavily with our Public Sector sales team to ensure our authorization path and timeline match the agencies we're actually selling into, sequencing sponsorship, boundary decisions, and control work around live deals rather than in isolation.

• Define and establish the authorization boundary, 3PAO selection and management, SSP and control narratives, NIST 800-53 baselines, POA&M, and continuous monitoring. Set ConMon up as automated, machine-readable evidence rather than a manual documentation exercise.

• Run StateRAMP and TX-RAMP alongside the federal track.

Your background looks something like this

• 5+ years of GRC experience in high-growth SaaS or technology companies, with direct responsibility for FedRAMP compliance programs

• Proven track record successfully contributing to SOC 2, ISO 27001, or similar enterprise compliance certifications

• Experience in data privacy regulations including CCPA, GDPR, and emerging AI governance frameworks

• Strong project management skills with ability to coordinate cross-functional teams under tight deadlines

• Excellent written and verbal communication skills to translate complex security concepts for diverse audiences

• Working knowledge of technical security controls and ability to collaborate effectively with engineering teams

Even better if you have

• Experience with AI/ML compliance frameworks and understanding of unique risks in conversational AI systems

• Background in healthcare or financial services with knowledge of HIPAA or PCI requirements

• Track record of building GRC programs at companies scaling from startup to enterprise

• Experience with GRC platforms like Vanta, Drata, or SecureFrame to automate compliance workflows

• Understanding of cloud security particularly Google Cloud Platform compliance and security features

Compensation

$190K – $275K + Offers Equity

Benefits

We proudly offer the following benefits for our full-time employees:

• Medical, Dental, and Vision benefits for you and your family

• Life Insurance and Disability Benefits

• Retirement Plan (e.g., 401K, pension)

• Parental Leave

• Fertility and family building benefits through Carrot

• Monthly stipend to support your wellness, lifestyle, and work-life balance

• Daily lunches and snacks in the office to keep you at your best

• Take what you need vacation policy (subject to local requirements; UK employees receive 25 days of statutory leave)

These benefits are described in more detail in Decagon’s policies, may vary by location, and can change at any time according to applicable compensation and benefits plans.