FedRAMP & Security Compliance Program Manager (SOC 2, PCI)

PlanetScale; Oregon; Hybrid; USD 175,000 - 200,000; Full time

Job summary

PlanetScale is seeking a Program Manager to oversee FedRAMP readiness and ATO processes, and to manage ongoing compliance commitments including SOC 1/2 and PCI DSS. You will coordinate audits, prepare plans, review evidence, and drive remediation across teams.

You will partner with IT, Engineering, Legal, and People teams to address data protection, privacy, and risk, track KPIs, and ensure evidence-driven compliance in a remote-first environment.

Qualifications

• 5+ years auditing/management in tech companies.
• FedRAMP, SOC 2, and PCI DSS experience.
• Strong written and verbal communication with diverse stakeholders.
• Experience with remote-first, asynchronous teams.
• Ability to explain complex compliance concepts to technical and non-technical audiences.
• Experience with cloud providers (AWS, Azure, GCP).

Responsibilities

• Oversee PlanetScale's FedRAMP readiness and ATO process from start to finish.
• Act as main compliance point of contact for audits/assessments (SOC 1/2, PCI, FedRAMP) incl. audit plan, evidence reviews, procedures, and walkthroughs.
• Establish, track, and report KPIs and maturity metrics for audit programs.
• Collaborate across IT, Engineering, Legal, and People to address privacy and data protection risks.
• Identify gaps in security/compliance and implement remediating controls using industry best practices.

Skills

FedRAMP expertise

SOC 2 controls

PCI DSS experience

Audit coordination

Stakeholder communication

Remote collaboration

Job description

PlanetScale is seeking a Program Manager to oversee FedRAMP readiness and ATO processes, and to manage ongoing compliance commitments including SOC 1/2 and PCI DSS. You will coordinate audits, prepare plans, review evidence, and drive remediation across teams.

You will partner with IT, Engineering, Legal, and People teams to address data protection, privacy, and risk, track KPIs, and ensure evidence-driven compliance in a remote-first environment.